Before you give an agency any customer data, settle three things in writing: which data goes over, what the agency may do with it, and what happens when the work ends. Article 12 of Turkey's Personal Data Protection Law, number 6698, makes the data controller jointly responsible with anyone who processes personal data on its behalf for taking the security measures the Law lists. Signing a contract with an agency therefore does not move your responsibility to the agency. This is not legal advice.
The situation fits a business that holds customer records and has just hired its first marketing agency: a subscription app, an online shop, a publisher with a reader list. Opening an ad account, an analytics property or an email list to an outside team raises the same questions each time. For the Search Console side of access management, see agency access to a client account and Search Console roles. The focus here is the confidentiality and data processor side of the paperwork.
What the agency asked for and what the job needs
Agencies can start with a broad request: "send us your user export." Treat that sentence as an opening position. The job, whether paid search, content or email, decides which data is needed, and that can be narrower than the export. The Law (Opens in a new tab) lists, among the principles that must be followed when processing personal data, that data be "connected with, limited to and proportionate to" the purposes for which it is processed. Read that as a rule for the request: what is needed to do the job goes over, and nothing else does.
Sorting a request into three piles
Pile one is data that identifies nobody: totals, rates, page views, category-level revenue. Pile two is data that points at a person: name, email, phone, device identifier, account history. The Law defines personal data as any information relating to an identified or identifiable natural person. Pile three is data the job never touches, such as free-text notes, payment details or identity documents.
| Data | Does the agency need it? | Practical suggestion |
|---|---|---|
| Aggregated performance figures | Reporting can run on them | Send summaries with no identifiers |
| Email list | Only if the agency sends the emails | Load it into the sending tool yourself or give a single-purpose upload |
| User names and phone numbers | Not for ad or content work | Mask or withhold |
| Activity history per user | Rarely, for segmentation | Reduce to group-level counts |
| Payment details | No marketing job requires them | Never share |
When the data describes health or body
A fitness product holds data that other businesses do not: workout logs, body measurements, heart-rate readings. Article 6 of the Law places certain categories, health among them, under a separate regime as special categories of personal data. Practical suggestion: keep anything that could describe a user's health or body out of agency hands unless a decision-maker has looked at that specific field and recorded why it is required.
Controller and processor in plain language
Article 3 of the Law defines both roles. The data controller determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system. The data processor processes personal data on behalf of the controller, on the strength of authority given by the controller. If you tell an agency what to do with your list and the agency does only that, the processor role is in play. If the agency decides for itself why and how to use the data, the picture changes for that part.
Why the contract should name the role
The Law contains no definition aimed at agencies or marketing vendors; the documentation has no statement on that. The role therefore depends on facts, and a contract sentence such as "the agency acts only on the client's written instructions and only for the purposes in this agreement" turns the facts into a written limit. Practical suggestion: put the sentence in the agency's obligations, not in the definitions, because that is where a dispute starts looking.
What Article 12 puts on the table
Article 12 is the article on data security. Its first paragraph requires the controller to take all necessary technical and administrative measures to provide an appropriate level of security, in order to prevent unlawful processing of personal data, prevent unlawful access to it and ensure its safekeeping. The second paragraph is the one that matters for agency work: where personal data is processed on behalf of the controller by another natural or legal person, the controller is jointly responsible with that person for taking the measures in the first paragraph.
- First paragraph: you need to know your own safeguards before handing data to anyone.
- Second paragraph: the agency's lapses are not only the agency's; joint responsibility is the Law's wording.
- Third paragraph: the controller must carry out or commission the audits needed to ensure the Law is applied. This duty concerns the controller's own organisation.
- Fourth paragraph: controllers and processors may not disclose what they learn contrary to the Law or use it outside the processing purpose, and the duty continues after they leave their role.
- Fifth paragraph: if processed data is obtained by others through unlawful means, the controller notifies the data subject and the Board as soon as possible.
The Law does not prescribe a certificate, a contract template or a mandatory clause list for agencies. The documentation has no statement on that, so the clause list in the next section is a practical choice.
Reading joint responsibility without overreading it
The Law's wording is that the controller is jointly responsible "for taking the measures". It speaks of the measures in the first paragraph, not of every consequence in every situation. Practical suggestion: treat the sentence as a reason to be involved, not as a reason to panic. You are expected to know what safeguards the agency applies, to ask for them in writing and to be able to show that you asked. The documentation has no statement on how responsibility is divided between a controller and a processor in a specific dispute, so the contract should say who does what, including who pays for notification work if an incident happens.
Writing a non-disclosure clause that outlasts the contract
The fourth paragraph gives the clause its skeleton. A confidentiality clause for customer data needs four parts: what counts as confidential, a ban on disclosure, a limit tying use to the contract's purpose, and a statement that the duty continues after the relationship ends. An NDA template can cover the first two and leave the last two to chance.
A sample frame
Practical suggestion: the agency uses personal data the client opens to it only for the work stated in the agreement, does not disclose it to third parties, gives access only to staff who need it for that work, and remains bound by these duties after the agreement ends. The sentence follows the three elements of the fourth paragraph: no disclosure, no use outside the purpose and continuation. Check that the agreement's definition of confidential information does not contradict it.
Definition trap
If the agreement defines confidential information as "business plans and pricing", customer data may fall outside it. Practical suggestion: add one line that names customer personal data as confidential information regardless of how it is marked or delivered.
People who touch the data
Agency staff, freelancers and tool vendors all see the data in some form. The Law has no separate provision for sub-suppliers; the documentation has no statement on that. A sentence requiring the agency to bind everyone who accesses the data to the same duty, in writing, is a contractual protection and worth asking for.
A clause menu for the processor section
Treat the table as a menu of contract headings, not a legal checklist. Each row connects a heading to a provision you have just read.
| Heading | What it fixes | Link to the Law |
|---|---|---|
| Purpose and instructions | Use only for the stated job and on written instructions | Article 4: connected, limited, proportionate |
| Data categories | Which fields are shared | Article 3: personal data definition |
| Security measures | Account protection, devices, file transfer | Article 12, first paragraph |
| Confidentiality | No disclosure, continues after exit | Article 12, fourth paragraph |
| Information on request | The agency explains its practice on request | Practical suggestion: add an information clause to the contract |
| Incident notice | Who tells you, how and how fast | Article 12, fifth paragraph |
| Return or deletion | Copies returned or erased at the end | Article 4: kept only as long as necessary |
Why the incident row weighs heavily on the client
The fifth paragraph puts the duty to notify on the controller. If something happens inside the agency and nobody tells you, you cannot meet that duty. The Law's phrase is "as soon as possible". Setting a stricter limit for the agency, for example a number of hours, is a drafting choice you can make; the Law itself does not name one for the agency. Name a person on each side, a channel that is monitored outside office hours, and the information the notice must carry: what happened, which data, which accounts and what the agency has already done. A notice that arrives late or without detail leaves you unable to judge whether your own duty has been triggered.
Access levels in Search Console and Analytics
A clause is only paper. The accounts decide what the agency can see. In Search Console (Opens in a new tab) Google describes three permission levels. An owner has full control and can add and remove users. A full user has view rights to all data and can take some actions, but cannot add or remove users or owners. A restricted user has simple view rights on data and limited tool access. Users are added under "Settings" and then "Users and permissions"; email groups are not allowed. Interface labels may look different if you use a localized interface.
Analytics roles and data restrictions
The Analytics help page (Opens in a new tab) lists the Administrator, Editor, Marketer, Analyst and Viewer roles. Administrators can manage users and assign any role or restriction. Editors control property settings but cannot manage users. Data restrictions named "No Cost Metrics" and "No Revenue Metrics" stop a user from seeing cost or revenue metrics. Practical suggestion: an agency doing reporting gets Viewer or Analyst, and if revenue is not part of its brief, the revenue restriction goes on.
Keep the access register
Write down every grant: account, person, role, date given, date to close. The register costs minutes to keep and turns the last day of the contract into a checklist instead of a search. Review the register whenever the agency adds a person or a campaign, not only at the end, so that the list you close on the final day is the list that is actually open.
How the data actually travels
The route matters because every route leaves copies. An attachment lands in mailboxes and download folders. A shared sheet can be closed with one click but can also be downloaded. A role inside your own tool keeps the data in your account. The agency's own tools put the data in places you do not control, so the contract appendix should list those tools and say how data leaves them.
Questions to ask about the agency's tooling
- Which tools will hold the data, and for what purpose each?
- Who inside the agency can open them?
- Where are the tools' servers? The Law's rules on transfers abroad are outside this topic, but the question can always be asked.
- How is the data removed from each tool when the job ends?
When one of your users writes to you about their data
Article 13 of the Law says a data subject sends requests about the application of the Law to the controller in writing or by other methods set by the Board. The controller concludes the requests as soon as possible depending on their nature and within thirty days at the latest, free of charge, subject to the exceptions the article states. The party answering is you. If the data sits with the agency, you need the agency to find it and send it back to you quickly.
A short cooperation clause
Practical suggestion: ask for three commitments. The agency forwards any request it receives instead of answering it. The agency tells you where the data in question is held. The agency applies your deletion or correction decision to its own copies and confirms in writing. The Law has no statement on how an agency must assist; this is a drafting choice.
Example scenario: a fitness app startup
Example scenario: a fitness app startup hires an agency for two things, paid app-install ads and a re-engagement email series. The startup holds names, emails, workout logs, weight entries, subscription status and device identifiers.
What goes over and what stays
For ads, the agency receives aggregated install and subscription counts through a Viewer role with the revenue restriction. For the email series the startup uploads only email addresses and a lapse-month label into the sending tool itself, so the agency never downloads a file. Workout logs and weight entries stay out entirely because the emails do not need them, and they describe health. Device identifiers stay inside the startup's tools.
What the agency answered
The agency says its email tool is a hosted service and that two team members will have logins. The startup asks for the two names, asks that logins use the agency's business accounts and asks the agency to delete the list from the tool after the final send, with a written note when done. The agency agrees. For ads, nobody needs personal data, so the Analytics access register simply gets a new line with a closing date.
Clauses the startup asks for
The contract states purpose limits, a confidentiality clause that names user data, a named list of agency staff with access, an incident notice contact, a request-forwarding clause and a deletion confirmation on the last day. The startup also asks which email tool the agency uses for its own reporting and gets the answer in writing.
Offboarding on the last day
Article 12's disclosure ban continues after the agency leaves its role, but that does not let the agency keep copies. Under Article 4, data are kept for the period required by the relevant legislation or necessary for the purpose for which they were processed. Once the job ends, the agency's reason to hold a copy ends with it.
- Remove the agency's users in Search Console and Analytics. In Search Console, open the user's menu and choose "Remove access". If a verified owner was added with a verification token on your site, remove the token as well.
- Close agency seats in ad accounts, email tools and shared folders.
- Ask in writing for confirmation that copies were returned or erased.
- Rotate passwords and API keys the agency held.
- Date the closure in the access register.
Practical suggestion: ask when backups that contain your data will fall out of the agency's systems, and write that date down.
Switching agencies mid-year
A handover between two agencies creates a period in which both hold access. Keep that period short and written. Sign the new agency's agreement first, give the new agency its lowest workable role, collect the final reports from the outgoing one, close its access and request its deletion confirmation. Put the overlap dates in the access register so you can explain them later.
Questions for the first agency call
| Question | What it tests | A solid answer looks like |
|---|---|---|
| Who on your team will open our data? | Scale of exposure | Named roles, written list |
| Which tools will hold it? | Hidden processing points | Tool names and purposes |
| How do you protect accounts and devices? | Article 12 measures | Concrete practice, not a slogan |
| How will you tell us about an incident? | Who can notify | Contact, channel, deadline |
| What happens to our data on exit? | Article 4 retention | Return or deletion with written proof |
An agency that answers in writing is easier to hold to its answers. The scoring approach in how to compare ad space offers can take a data-handling criterion alongside price and scope.
Checklist before the first file is shared
- Every shared field is listed with its purpose.
- Identifiers the job does not need are removed or masked.
- The contract names the agency's role and carries the written-instruction sentence.
- The confidentiality clause covers customer data and survives the contract.
- Security measures, tools and staff with access are listed.
- An incident contact, channel and deadline are set.
- Accounts open at the lowest workable role and the register is current.
- Return and deletion steps, including backups, are written.
- Consent-dependent flows were checked against cookie consent and measurement loss and, for email, email consent and newsletter subscriptions.
Mistakes that look like protection
"The NDA covers customer data"
Only if it says so. An NDA can define confidential information narrowly and say nothing about retention, deletion or incident notice.
"We only gave a Viewer role"
A Viewer in an analytics property can still see everything the property holds, unless a data restriction applies. Role choice is a data-sharing decision.
"Anonymised means safe"
The Law defines personal data as information relating to an identifiable person. After masking one field, check whether the remaining fields together still point at someone.
"The agency will tell us if something goes wrong"
Not unless the contract says who, how and when. The duty to notify sits with you under the fifth paragraph, so the information has to reach you first.
"A viewer cannot export anything"
Role descriptions say what a role can change, not what a person can copy down by screenshot or transcription. Treat any visible data as shareable data when you choose a role.
"We can sort it out when the contract ends"
Closing access and collecting deletion confirmation take minutes when the register and clause already exist, and days when they do not.
Frequently Asked Questions
Do we have to give an agency our whole user list?
No. Give the narrowest set of data the job needs. The Law lists, among its principles, that data be connected with, limited to and proportionate to the purposes of processing.
Is an agency a data processor?
Article 3 defines a processor as someone who processes personal data on behalf of the controller, on the strength of authority given by the controller. An agency working under your instructions fits that description, but the role depends on the facts and should be written into the contract.
Who answers to the Board if the agency suffers a breach?
The fifth paragraph of Article 12 puts the duty to notify the data subject and the Board on the controller. The second paragraph makes the controller jointly responsible with the processor for the security measures. This is not legal advice.
Does a confidentiality promise end with the contract?
The fourth paragraph of Article 12 says the duty not to disclose or misuse data continues after the person leaves their role. Repeat that continuity in the contract wording.
What does a restricted Search Console user see?
Google describes restricted users as having simple view rights on data, with limited tool access, and says only owners can add users.
How do we make sure the agency deletes our data?
Write the return or deletion step and a written confirmation into the contract, close every access on the final day, rotate shared credentials and ask when backups will drop out.
Conclusion
Give an agency the narrowest data the job needs, name its role and purpose limits in the contract, make the confidentiality duty survive the contract, set an incident contact and a deletion step, and open accounts at the lowest workable role. Article 12 leaves you jointly responsible with the agency for the measures, so every field you share needs a reason. This is not legal advice.
If you want link work placed on publisher sites without handing over any customer data, take a look at the backlink packages page.
Post a comment
Please log in to leave a comment. Login