Skip to content
+90 531 883 33 88

Mergers and Acquisitions

Legal Due Diligence Guide: Investment, Company Review, Contracts and 10 Critical Risks

A desk where two people examine company contracts, organizational information and risk documents with a magnifying glass and a laptop.
Author: Published: About 29 min read

Institutional legal review and control: Güneş & Güneş Law Firm

Published by: Güneş & Güneş Law Firm

Summary

What is legal due diligence? The review process in investments and company transfers, 10 critical risks, NDA, term sheet, SPA, KVKK and closing agreements.

Summary

Legal due diligence is the process of examining, on the basis of documents, a company’s rights, liabilities and the risks that may arise from the transaction, before an investment is made in the company or its shares or business are acquired. It is not merely a check of the financial statements: the ownership structure, authority to represent, key contracts, intellectual property, employee relations, personal data, permits, disputes and post-transaction liabilities are assessed together. Not every deficiency found prevents the investment; what is decisive is the true legal nature of the risk, whether it can be remedied, how it is allocated in the contract and which steps will be completed before closing.

What is due diligence, and in which transactions is it carried out?

A company may have a strong product, a customer portfolio and growth potential. But when the investor examines the company’s shares, contracts and software, the investor may find a difference between the visible economic value and the rights that are legally secured. That software works does not prove that the authority to use and transfer it belongs to the company; that the company earns revenue does not prove that its contracts will continue upon a change of control; and that the founders agree does not prove that the relationship among the shareholders is legally sound.

Due diligence (fact-finding / careful examination) is the buyer’s or investor’s systematic evaluation of information and documents in order to support the decision on the transaction. Legal review may be carried out in coordination with financial, tax, commercial, technical, cybersecurity, environmental and operational reviews. None of these replaces the others on its own. A legal report does not guarantee that the company will be profitable in the future; it shows the legal risks for the transaction and the findings based on documents.

This review is not used only in technology ventures. Due diligence work, with a scope that varies, may be carried out in venture capital investments, minority or majority share acquisitions, company mergers and acquisitions, transfers of a business or of specific assets, joint ventures, loan financings and strategic business collaborations. The type of transaction determines the documents to be examined and the legal rules to be applied.

The difference between legal, financial, tax and technical reviews

  • Legal due diligence: Examines the company’s legal existence, title to rights, corporate resolutions, contracts, permits, liabilities and disputes.
  • Financial due diligence: Evaluates revenue, cash flow, indebtedness, working capital, accounting policies and financial assumptions.
  • Tax due diligence: Examines tax returns, audit and tax assessment risks, incentive conditions, liabilities of prior periods and transaction taxes.
  • Technical and cybersecurity review: Focuses on matters such as software architecture, source code dependencies, access authorizations, security vulnerabilities, cloud infrastructure and business continuity.

For example, a contract granting a customer an unlimited and free right of use concerns the legal review; its effect on future-period revenue concerns the financial review; and the technical dependency of an open-source component in use concerns the technical review. These three findings must be read together.

How does the legal due diligence process proceed?

1. The transaction structure and the scope of the review are determined

First, which of the options of share transfer, investment through a capital increase, asset transfer or merger is planned; which companies and periods the parties will examine; and the target company’s field of activity, group structure, countries and regulatory obligations are established. A minority share investment and an acquisition in which control is transferred entirely cannot be concluded with the same review list.

The scope of the review, data and document requests, division of tasks, conflict-of-interest checks, fees and the purpose for which the report will be used can be clarified in a separate advisory/engagement agreement. A legal due diligence report and investment advice are different from each other; who may rely on the report and the limit on sharing it with third parties are also regulated separately.

2. The confidentiality agreement and the data room arrangement are set up

The parties often sign a confidentiality agreement (NDA) and, where necessary, a letter of intent (LOI) or a term sheet setting out preconditions. Who may access the documents to be opened, trade secrets, personal data, authority to download files, retention period, data destruction and the obligations when the negotiations end are determined. If highly commercially sensitive competitor data is involved, a restricted access/clean team method in compliance with competition law may be considered.

A virtual data room (virtual data room / VDR) is not merely a folder. It is a control environment in terms of access logs, versions, tracking of questions and answers, document confidentiality, authorization and listing of missing documents. Employee health data, customer identities or trade secrets cannot be shared without limit merely because the buyer asked; the purpose and the legal ground of the transfer are examined separately.

3. Documents are reviewed; deficiencies and counter-explanations are compared

The legal team evaluates the trade registry, articles of association, share ledger, board resolutions, financing and security documents, key customer/supplier contracts, employment law files, licenses, intellectual property records, dispute documents and compliance processes. In a regular Q&A (question and answer) round, clarification is requested on contradictory information. The failure to provide documents does not prove that the relevant legal deficiency necessarily exists; but it limits the scope of the review and the level of confidence in the finding.

4. Findings are classified by importance and reported

At the end of the review, instead of a general summary, a legal due diligence report is prepared showing the finding, the supporting document, the relevant law, the condition under which the risk would materialize, the effect on the value/feasibility of the transaction, the recommended remedy, the person responsible and the time of completion. Depending on need, a full-scope report or a red flag report addressing primarily the critical matters may be prepared. A red flag report does not mean that all areas of law have been examined in detail.

5. Risks are reflected in the contract and the closing steps

The same method is not always used for an identified deficiency. First, the document may be completed; obtaining a permit or correcting a share transfer may be made a condition to closing; the price may be adjusted; and a specific indemnity, security or escrow (deposit/conditional payment) may be arranged for a specific liability. In some cases the investor accepts a certain risk; in others, walking away from the transaction may be rational. The value of a due diligence report depends on its results finding real counterparts in the investment agreement.

Which documents and records should be prepared for due diligence?

The list below is a general starting inventory. It is expanded according to the regulated sector, the type of company, activity abroad and the structure of the transaction.

Area of reviewCore documents and control question
Company and managementTrade registry, articles of association, share ledger, general assembly and board of directors/manager resolutions; are authority to represent and to sign correct?
Capital and ownershipPaid-in/committed capital, share transfers, share certificates, cap table, options and conversion rights; are the records consistent with one another?
Financing and securityLoans, suretyships, pledges, mortgages, venture financing, investor rights and security records; is there any record affecting a change of control?
Commercial contractsKey customer, supplier, distributor, lease, license and service contracts; what are the termination, assignment, exclusivity or change of control provisions?
Intellectual and industrial propertySoftware development, transfers of economic rights, trademarks, patents, domain names, code and open-source inventory; which rights can the company use?
Employees and contractorsEmployment, confidentiality, invention, consulting, incentive and outsourcing contracts; is there labor-claim and title-to-rights risk?
Data and digital activityKVKK privacy notices and legal grounds, data processor contracts, transfer and security records; is the operation of the model lawful?
Disputes and compliancePending lawsuits, enforcement files, administrative acts, licenses, audits, insurance and regulatory notifications; is there any hidden contingent liability?
Tax and public debtTax returns, tax audits, SGK records, incentive documents and public debts; what liabilities are carried over from prior periods?

The document list and access to the data room are different from each other: That a contract has been uploaded does not mean that the signatures, annexes, current amendments and actual practice have been examined. Independent records should be compared, especially for customer revenue, software licenses and share ratios.

The 10 legal risks investors examine first in the due diligence process

1. No written agreement among the founders

Many startups begin with an oral relationship of trust. An approach of “we will make an agreement when investment comes” can create gaps as to who will make which decisions, who will provide which financial or intellectual contribution, and what the rights will be in the event of a split.

A founder agreement (agreement among the founders) may address the division of work, time and financing commitments, confidentiality, conflicts of interest, competition and customer relations, vesting of intellectual property rights in the company, dispute resolution, binding undertakings concerning shares and the consequences of departure. Contract provisions alone do not override the statutory powers of the company’s bodies or the arrangements that must be made in the articles of association. The consistency of share transfer, management and privilege provisions with the Turkish Commercial Code (TTK) is examined separately.

For the investor, the risk is not only a quarrel among founders. It is that rights that should belong to the company remain with an individual, that authority to represent is uncertain, or that oral promises about shares later create a dispute. A written founder arrangement is one of the important documents that can be corrected before an investment is postponed.

2. The cap table, the share ledger and the trade registry records do not match

The cap table (capital and share ownership table) serves to show the existing shareholders’ ratios, the financing agreements, potential rights to acquire shares and possible dilution. However, depending on the company type, the share ledger, share certificate, share transfer document, notarial act, general assembly approval and trade registry records are also decisive. A percentage written in an Excel table does not by itself prove that a person legally owns that share.

Small shares given in the past to a consultant, a former employee or a person from the founders’ circle may in particular have an effect in terms of pre-emption rights, veto powers or restrictions on share transfers. Shares whose price was committed but not paid, confusion between existing and conditional options, the anti-dilution rights of earlier investors and in-kind/cash capital transactions are likewise examined separately.

A due diligence finding cannot be remedied merely by redrawing the cap table. The documents and resolutions that create legal share ownership must be corrected or completed. For a new investment round, the pre-investment and post-investment fully diluted (taking potential share rights into account) tables should be explained with different scenarios.

3. The company type, capital and corporate structure are not suited to the transaction

In Türkiye, a limited liability company structure may be chosen at the start of a startup. However, with respect to the rights the investor wishes to obtain, new share issuances, transfer processes, privileges and later financing rounds, a joint-stock company structure may be more suitable in some transactions. This does not mean that a limited liability company cannot receive investment or that every venture must automatically convert into a joint-stock company; the transaction structure and existing contracts should be examined together.

For joint-stock companies newly formed from January 1, 2024, the initial capital has been set at Turkish lira (TL) 250,000, for limited liability companies at TL 50,000, and for non-publicly held joint-stock companies that adopt the registered capital system at TL 500,000. For companies formed earlier, TTK Provisional Article 15 also applies: under the current regulation and the 2026 announcements of the institutions, there is a compliance period until December 31, 2026; since the law grants the Ministry the power to extend, the current period should be checked separately at the date of the transaction. The consequences specified by law for failing to comply are severe. [1, 2]

The review is not limited to the minimum capital alone. The proper constitution of the company’s bodies, the currency of the authority to represent, privileges, voting and decision quorums, the provisions on loss of capital and over-indebtedness, the existence of a pledge or restriction on shares, past capital increases and group company transactions are addressed. It is determined whether the company in which the investment decision is made is a company that can lawfully perform the contract.

4. The software and other intellectual property rights are not consolidated in the company

In technology investments, the basic question is not only “Does the product work?”; it is “Who can use the economic rights of this product, to what extent and on what evidence?” The software’s having been developed in the founder’s personal account, the first version’s having been prepared before the company was formed, the agency’s not delivering the source code or the trademark’s being registered in the founder’s name are different legal problems.

Under Law No. 5846 on Intellectual and Artistic Works, computer programs are among the types of works that can be protected. FSEK Article 52 provides that contracts and dispositions concerning economic rights be in writing and that the rights concerned be specified separately. However, the regime of exercising rights under FSEK Article 18 for employees’ works differs from the contractual-transfer requirement for independent contractors. Without assessing the nature of the work, the contract, the author and the time of production, the conclusion that “if there is no separate transfer for all employees, the company has no rights whatsoever” cannot be drawn. [3]

The review extends to source code repository accounts, the history of work production, development agreements, the rights of adaptation/reproduction/distribution and communication to the public, license limits, third-party dependencies, the owner of the domain name and cloud accounts, access roles and the company’s control over independent operation. Being able to access a system does not mean having taken over its economic rights or all its management authority. Especially in SaaS and artificial intelligence ventures, a title-to-rights assessment cannot be completed without understanding APIs, data, models, subscriptions, external platforms and export/portability restrictions.

5. Freelancer and agency contracts do not regulate the real scope of the work

Early-stage products may be developed with independent developers, designers, agencies and consultants. Making a payment or issuing an invoice does not by itself show that all the economic rights sought to be used, the source code, the design files and the technical account have passed to the company. The scope of the right and the form of delivery should be tied to the contract as much as the work itself.

The job description, milestones, acceptance/testing criteria, remedying of defects and incomplete work, delivery of the source code/repository, transfer of developer accounts or appropriate authorization definitions, reuse licenses, obligations of open-source components, confidentiality, status as data processor and transition support upon termination should be addressed separately from one another. The transfer of economic rights or the choice of a license is assessed together with the form and scope rules of FSEK. If a subcontractor has been used, whether the rights the main contractor can transfer really lie with it is also investigated.

The investor sees in particular that a demonstration of a working product and a legally and technically sustainable right of operation are not the same thing. The deficiency can sometimes be remedied by a supplementary economic-rights transfer agreement, sometimes by securing a license/permission, and sometimes by redeveloping a critical component of the product.

6. Missing protection of trademarks, patents, employee inventions and trade secrets

Trademarks, patents, designs, domain names, customer lists, algorithms, know-how and trade secrets are not subject to the same protection regime. A trademark application made in a founder’s name may call for the necessary transfer/license steps in the company’s favor. Disclosing a technical invention without a novelty assessment can weaken the patent strategy; not every software idea is patentable. The protection of trade secrets depends on the information’s nature as a secret and on reasonable confidentiality measures.

Industrial Property Law No. 6769 and the relevant regulation introduce a special regime of notification, claim of rights, application and remuneration for employee inventions. The written full or partial claim of rights within four months from the date the properly made notification of a service invention reaches the employer, and the consequences of not making a claim within the period, should be assessed separately. The employer’s acquisition of rights and the matter of the remuneration payable to the employee must not be confused with each other. [4, 5]

In due diligence, one does not stop at registration documents; the currency of applications, their classes, geographic scope, rights of a previous employer or a university, joint development relationships, license and pledge records, the actual administrators of registered domain names and trade secret protocols are also examined.

7. KVKK, transfers of data abroad and gaps in digital compliance

In SaaS, fintech, healthtech, edtech, e-commerce, marketplace and artificial intelligence business models, the processing of personal data is often at the center of the business. That a privacy notice was given does not mean that a separate and valid legal ground exists for each processing; explicit consent is likewise not mandatory for every activity or the single method that solves every problem. The roles of data controller/data processor, retention and destruction, access control, data breach management, use of employee and customer data, sector-specific secrecy obligations and, where necessary, the obligation to register with the Data Controllers’ Registry Information System (VERBİS) are assessed on the basis of the specific activity.

In the new transfer regime of Law No. 6698 on Personal Data Protection (KVKK) Article 9, which entered into force on June 1, 2024, an adequacy decision, appropriate safeguards and the exceptional transfer situations listed in the law are different tiers. A standard contract is an appropriate-safeguard method under certain conditions; signing a template alone does not make every data transfer lawful. A properly signed standard contract must be notified to the Authority within five business days. Matters such as modification of the texts published by the Authority, authority to sign and the Turkish text must also be checked separately. [6, 7]

For cloud services, customer relationship systems, analytics tools and external artificial intelligence services, the countries in which the data is processed, sub-processors, retention periods, security controls and the right to audit should be examined. It should not be forgotten that, especially in regulated sectors such as health or finance, special legislation may apply in addition to KVKK. The due diligence question should not be only “will a fine be imposed?” but “Is the business model built on this data legally sustainable?”

8. Gaps in employee, executive, non-competition and confidentiality agreements

The product and customer relationships that make up a company’s value are often tied to founders, executives, developers and sales teams. These persons’ employment contracts, de facto duties, pay and bonuses, termination records, overtime and leave claims, social security status, confidentiality obligations and post-departure restrictions should be examined.

Under Article 444 et seq. of the Turkish Code of Obligations (TBK), a post-employment non-competition covenant cannot be imposed without limit on every employee. The employee’s opportunity to obtain knowledge of the customer circle or production secrets, the likelihood of significant harm to the employer, the scope of the restriction in terms of place, duration and type of work, and the employee’s economic future should be evaluated. As a general rule, a period exceeding two years can be considered only within the statutory exception conditions; an excessive restriction may be limited by the court.

Non-solicitation provisions for customers and employees, intellectual property rights, return of company devices, cutting off access to the source code and the retention of personal data are separate matters. Employing a freelancer in practice like an employee can also create social security and labor law risk. What matters as much as the contract language is the de facto working arrangement.

9. No ESOP, vesting or founder departure mechanisms

Vesting is a contractual structure that makes certain rights, or the possibility of obtaining them, conditional on time and conditions; reverse vesting is one that aims to make repurchase/transfer obligations concerning some founder shares conditional on certain events. The good leaver / bad leaver distinction can differentiate the consequences according to the reason for departure. However, if foreign examples are copied directly, problems may arise with respect to Turkish company law, the form of share transfer, mandatory provisions and proportionality.

An ESOP (employee share/option incentive plan) can be structured as a real share option, a contractual model operating through a capital increase or share transfer, a bonus, or different arrangements such as a phantom share (cash right indexed to share value). Each model has different consequences in terms of tax, payroll, share transfer, accounting and company body resolutions. A cash bonus does not by itself create share ownership; a signed option is not deemed to have automatically become a registered share without the necessary company steps.

The review asks whether the departing founder holds all of his or her shares, under what conditions the rights were acquired, how the capital structure is expected to be diluted in the future, the written and oral share promises made in the past and the legal enforceability of bad-leaver grounds. The subject of the transaction is not only retaining human resources; it is whether the ownership arrangement will work in later investment rounds.

10. Incorrectly regulated investment documents, crowdfunding and exit provisions

In an investment round, the term sheet (document of preconditions), the shareholders’ agreement (SHA), the share purchase/transfer or participation agreement, amendments to the articles of association, the share ledger and board resolutions are assessed together. Vetoes and privileges, information and audit rights, anti-dilution rights, the liquidation preference (order of priority return on liquidation or exit), pre-emption/participation/drag-along rights on share transfers, and management representation in particular must be set up consistently with one another.

The tag along (joining a sale together) and drag along (compelling a joint sale) provisions do not serve the same purpose. SAFE or convertible note (financing/debt that can convert into shares) models derived from foreign law likewise do not automatically produce the same legal result in Türkiye. When, through which company transaction and on the basis of which valuation the share will arise; the legal nature of the claim, the interest, tax and foreign exchange dimension must also be determined separately. Where a foreign investor is involved, the applicable law, jurisdiction, international taxation and foreign investment notifications are added to the review.

In crowdfunding, Capital Markets Law No. 6362 Article 35/A and the Capital Markets Board’s Crowdfunding Communiqué No. III-35/A.2 are important with regard to the platform, the information form, disclosure to the investor, the campaign, and share- and debt-based structures. It cannot be assumed that every crowdfunding campaign is subject to the same company type, permit or report requirement; the communiqué in force at the date of the transaction, the Board’s regulations and the nature of the campaign should be checked together. [8]

In the event of the transfer of shares to another investor or the sale of the company at exit, a change of control may require approval under contracts and a competition law analysis. With the Competition Authority’s amendments of February 11, 2026, the general notification thresholds and the technology undertaking regime were updated. According to the Authority’s statement, some thresholds were raised to TL 3 billion Türkiye turnover, TL 1 billion stand-alone Türkiye turnover and TL 9 billion worldwide turnover; for technology undertakings resident in Türkiye, a stand-alone threshold of TL 250 million was regulated with special conditions. Whether approval is required cannot be determined by looking at the turnover of a single company; the parties to the transaction, control and the relevant combinations of thresholds should be examined. [9]

Which contracts are drawn up in the due diligence process?

Due diligence is not a single “due diligence contract.” The service/reporting relationship of the review, the documents governing the parties’ sharing of information, and the binding transaction contracts concerning the transfer of the investment are distinguished from one another. Some documents are signed at an early stage, others after the findings become clear.

DocumentCore function and control
Legal review/advisory agreementScope of the review, fee, timetable, areas of expertise, addressee of the report, limits of use and liability
NDA / confidentiality agreementSharing of information, permitted use, persons, exceptions, term, data security, return/destruction
LOI / term sheetTransaction structure, preliminary valuation, timeline, exclusivity, expenses and binding/non-binding provisions
SPA / share purchase and sale agreementThe shares transferred, price, payment, representations and warranties, indemnification, closing, termination and disputes
Subscription / participation or capital increase documentsIssuance and acquisition of new shares, investment amount, body resolutions, share ownership and closing steps
SHA / shareholders’ agreementManagement, access to information, veto, transfer, investor rights, exit and dispute arrangements
Escrow / security agreementHolding of the price for certain risks or conditions, release and dispute procedure
Post-closing service/compliance protocolPermits, account access, post-transfer transition support and corrections to be completed

Why should the NDA, LOI and term sheet be read carefully?

The statement “a letter of intent is not binding” cannot be accepted as correct with respect to all provisions. The parties may expressly give binding force to confidentiality, exclusivity, cost sharing, dispute resolution or notice provisions. An investor’s request to conduct negotiations unilaterally for a certain period may restrict other financing options. What will happen to the use of information and the duties of retention once data room access ends should also be agreed.

The difference between representations and warranties, specific indemnity and escrow

The representations and warranties provisions given by the seller or the founder create a contractual assurance about the company’s condition. An indemnity (special indemnity undertaking) may be arranged for risk allocation specific to the occurrence of certain findings. Escrow, in some cases, holds part of the price until the conditions in the contract are met. None of these instruments, on its own, eliminates a tax debt, transfers an intellectual property right or substitutes for a public permit.

The liability cap, claim period, disclosure annexes, materiality threshold, offsetting, calculation of loss and the system of proof can materially affect the parties’ post-transaction rights. Incorrectly reflecting a finding in the investment agreement leaves risk unprotected even if a comprehensive due diligence has been carried out.

How do the identified risks affect the investment decision?

A legal finding does not always mean rejection of the transaction. Whether the problem can be remedied legally, and at what stage it can be remedied, should be determined.

FindingPossible transactional response
Uncertainty in core software rightsTitle-to-rights review; making a valid transfer/license and delivery a condition to closing
Mismatch in share ownership recordsPostponing closing until the corporate records and necessary share transactions are corrected
Change of control condition in a critical customer contractCounterparty approval, contract amendment or valuation/price assessment
KVKK compliance gapCorrecting the data flow, a plan to complete processes and contracts; special protection where necessary
Tax, SGK or litigation riskDocumented debt analysis, specific indemnity, security, price adjustment or acceptance of the risk
Need for Competition Board approvalAppropriately making conditional the closing of a transaction that cannot be legally completed without the required approval

For the investor, the basic method is not to break the link of existence of the risk → its evidence → its legal consequence → the contract provision → closing control. For the company, it should be separated realistically which deficiency can be remedied immediately and which in an agreed compliance timetable.

How should the seller and the startup prepare for due diligence before an investment?

Before the review begins, it may be useful to form a working group of those responsible for management, legal, finance, human resources, technology and data protection. Version and responsible person are determined for the information in the data room. Instead of trying to hide every problem of the past, the company should be able to explain which document it cannot provide and why, and its plan for a solution.

  1. Reconcile the company’s current registry, share ledger, body resolutions and capital records; set aside the necessary corporate resolutions.
  2. Take an inventory of the intellectual property rights coming from founders, employees and external developers and of the technical administration accounts.
  3. Classify the most important revenue and expense contracts together with their termination, approval, assignability and exclusivity provisions.
  4. Identify the items in KVKK, license, permit, tax, SGK and lawsuit files that create deadline or closing risk.
  5. Compare existing investor rights, option promises, incentive plans and future dilution scenarios.
  6. Open a data room with confidentiality, data minimization and an authorization arrangement in place, and set a responsible person and date for each missing document.
  7. Mark in the closing checklist to which transaction document the findings should be carried.

Important distinction: Presenting documents in an orderly way does not create a presumption of legal compliance. The content of the documents and the actual operation must also be examined. Moreover, answering an investor’s questions correctly does not mean that confidentiality and personal data protection obligations have ended.

How are the scope and fees of a legal due diligence service determined?

The scope of a legal review varies according to the size of the company, group companies, the number of countries and sectors, the type of transaction, the volume of documents, the review period and the level of detail of the report. The amount of the investment is not by itself the measure of the review work or of the attorney’s fee. In an early-stage investment there may be three important contracts, whereas in a smaller investment in a regulated sector many licenses and administrative conditions may have to be examined.

In the engagement, the legal entities to be examined, areas excluded from scope, third-party expert work, access to the data room, the form of the report, additional rounds of questions, whether negotiation of the contract is included, expenses, confidentiality, assumptions about the accuracy of documents and legal liabilities should be explained. Preparing the review report and negotiating the investment agreement and conducting the closing may not be the same service. A specific offer and fee are determined within the framework of the applicable attorneyship legislation and the express contract between the parties.

As to time, there is no single end date set by law for all due diligence work. The timetable varies according to when the documents are delivered, counter-explanations, the permits required and the negotiation of the transaction documents. The report’s cut-off date is important; developments emerging after that date should be monitored separately and, if necessary, an update requested.

Conclusion

Legal due diligence is not merely a checklist that supports the investment decision; it is a contractual preparation process that makes transaction risks visible and manageable. Deciding solely on the basis of the product and valuation, without verifying the company’s share structure, clarifying its rights over software and trademarks, the effect of its contracts on a change of control, its employee and data protection obligations, and its permit and litigation risks, may increase legal uncertainty.

The result of a successful review is not always “there is no risk.” A realistic result clearly shows which risk will be remedied, which risk will be shared through price or security, which permit will be a condition to closing and which liability the parties accept. Investability depends not only on the company’s promise of growth but also on a structure that can legally sustain that promise.

Related articles: Starting a Startup Is Not the Same as Forming a Company: Building an Investable Structure from Idea to Exit and Startup Law Guide: Company Formation, Ownership, Investment and Intellectual Property Rights cover pre-investment preparation from the founder’s side; Shareholders’ Agreement: Voting Arrangements, Co-Sale, Exit and Breach of Contract, Limited Liability Company Share Transfer: Notary, General Assembly Approval, Registration and Liability and Joint-Stock Company Share Transfer: Registered and Bearer Shares, Share Ledger and MKK Notification cover share transfers and shareholder agreements in detail.

Frequently Asked Questions

What is legal due diligence?

It is the document-based examination of rights, liabilities, contracts, permits, ownership, intellectual property and disputes before an investment, transfer or shareholding transaction is carried out on a company or asset. It does not replace a financial or technical review.

Who commissions a due diligence review?

The buyer, the investor, the financing provider, or the seller/company for pre-transaction preparation may commission it. The review agreement should determine the addressee of the report, its scope and which persons may rely on the report.

Is a due diligence agreement the same as an NDA?

No. The legal advisory agreement governs the professional scope of the review and the reporting; the NDA governs the confidentiality of the information the parties share. For the investment to take place, a share purchase, capital increase or other transaction agreements are also required.

How long does due diligence take and how is its fee determined?

There is no single legal period or fixed fee for all companies. The duration and price of the review are determined in the contract according to the characteristics of the companies, the countries, the volume of documents, the sector and the scope of the report. The competition or sector-specific permit process may require separate time.

If the due diligence report is favorable, is the investment necessarily made?

No. A legal report sets out the legal risks identified from the existing documents; it is not a commercial valuation, the success of the product, a financing decision or a guarantee of future profitability.

Must a startup be a joint-stock company to receive investment?

There is no automatic requirement for every investment transaction. The company type, the legal structure of the investment, the share and management rights requested and any special regulation are assessed together. In some investment models, a joint-stock company structure may be more suitable or necessary because of a special regulation.

Does paying an employee or a freelancer transfer all the rights in the software to the company?

Not by itself. For works that employees create within their jobs, FSEK Article 18 should be examined, and for economic-rights transfers with independent developers, Article 52 in particular and the specific contract provisions. Delivery of the code, transfer of intellectual property rights and control of the technical accounts are separate matters.

Once a KVKK standard contract is signed, do all transfers abroad become free?

No. The transfer conditions in KVKK Article 9 and the applicable safeguard method are examined. If an appropriate standard contract has been used, the obligation to notify the Authority within five business days of signing is also assessed.

How is a risk identified in due diligence addressed in the investment agreement?

Depending on the nature of the risk, a condition precedent to closing, an undertaking to correct, representations and warranties, specific indemnity, a price adjustment, security or escrow may be provided for. Obligations arising from public law do not disappear merely by adding a provision to the contract.

Is Competition Board approval always required in company acquisitions?

No. The change of control and the current notification conditions of Communiqué No. 2010/4 are examined. With the amendments of February 11, 2026, the general turnover thresholds and the special conditions for technology undertakings were updated; looking only at the turnover of the target or the buyer alone may not be sufficient.

Sources and legal bases

  1. Ministry of Trade of the Republic of Türkiye, “Minimum Capital Amounts for Joint-Stock and Limited Liability Companies Have Been Increased” (November 30, 2023). Presidential Decree No. 7887; amounts for formations after January 1, 2024.
  2. Aegean Region Chamber of Industry (Ege Bölgesi Sanayi Odası), announcement on TOBB’s letter of August 14, 2026 (August 19, 2026). Law No. 6102 TTK Provisional Article 15 and capital compliance of existing companies.
  3. Ministry of Culture and Tourism of the Republic of Türkiye, General Directorate of Copyright, “Laws” — Law No. 5846 on Intellectual and Artistic Works. In particular Articles 18 and 52.
  4. TÜRKPATENT, Legislation — Industrial Property Law No. 6769 and related regulations. Employee inventions; Article 113 et seq.
  5. TÜRKPATENT, Employee Inventions Implementation Guide (June 30, 2020). Notification, the employer’s claim of rights and distinctions regarding remuneration.
  6. Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu), “Transfers Abroad”. Law No. 6698 Article 9; the regime after 2024.
  7. Personal Data Protection Authority, “Matters to Be Considered in Standard Contracts to Be Used in Transfers of Personal Data Abroad”. Signing and the five-business-day notification.
  8. Capital Markets Board (Sermaye Piyasası Kurulu), Crowdfunding Communiqué (III-35/A.2). Campaign and information form provisions.
  9. Competition Authority (Rekabet Kurumu), “Merger and Acquisition Legislation Updated!” (February 11, 2026). Current thresholds, technology undertakings and control analysis.
  10. National Venture Capital Association, Model Legal Documents. Comparative contract architecture; not binding legislation for Türkiye.

AUTHOR

Av. Umut Güneş

Güneş & Güneş Law Firm

Send feedback or a correction

You can send us comments or corrections about sources, dates, content or links.

Mentioning the article title and the relevant section is enough. Please do not send personal case details or documents.

GÜNEŞ & GÜNEŞ LAW FIRM

Contact and Consultation

Our Antalya-based law firm, in practice since 1999, offers communication in Turkish, English, German and Russian on legal matters connected to Türkiye.

Whether you are in Türkiye or abroad, you can reach us by phone, WhatsApp, e-mail, in person or by video conference.

Consultation process and information needed

To assess your legal situation, review the legal aspects of a planned transaction or identify the available remedies, you can share a short summary of the matter, your request and your preferred language.

It helps to mention any file or transaction details, decisions, notifications or notices with deadlines, and important dates you know of. The scope of services, required documents and fees are assessed separately.

Related practice areas