When an accountant office grows, an inevitable moment arrives: one (or several) taxpayers are handed over to another accountant. Whatever the reason — geography, sector expertise, the accountant's retirement, partner separation — when transfer day comes, the software stack must support it.
PratikYedek thought about this scenario from the beginning. In this article we walk through how transfer works, what KVKK says, and the technical flow step by step.
Scenario: from Accountant A to Accountant B
Ahmet has been a CPA for 12 years. His portfolio includes 180 taxpayers. His spouse is moving to Antalya for health reasons. Ahmet wants to close his Istanbul office and transfer 130 of his taxpayers to his partner Mehmet.
Traditional approach:
- Taxpayers are called one by one and explicit consent for transfer is collected
- Each taxpayer's Bien e-invoice panel / ERP / backup subscription is migrated manually
- KVKK Privacy Notice is re-signed for the new accountant
- Old backups — unless explicitly preserved — are lost when Ahmet's office closes
This process takes 3-4 weeks on average. Due to friction most accountants say "let's restart backups" on transfer day, and historical records vanish.
PratikYedek's solution: package transfer primitive
In PratikYedek each taxpayer is modeled as a package. The package covers:
- The taxpayer's full backup history (5-year VUK 242 retention)
- Audit-share records (KVKK § 12 access logs)
- KVKK consent records (consent + timestamp + IP)
- Bien/Uyumsoft/İzibiz/Foriba/CRSSoft integration credentials (AES-256-GCM sealed)
- Encryption master key reference (a reference, not the key — the actual key stays with the accountant)
Transfer flow:
- Accountant A clicks "Start Transfer" → selects the taxpayer → looks up target accountant B (matched by CPA license number in DB)
- Accountant B approves → DB transaction begins (atomic)
- Taxpayer package moves to B; A retains 30-day read-only audit-share access (auto-revoked after that)
- Taxpayer receives email + SMS notification: "Your accountant is now Mehmet. Your backup subscription continues unchanged."
- KVKK Privacy Notice is re-signed by e-signature with "new data controller" updated (legally required)
Total: 4-6 minutes.
KVKK § 11 framework
KVKK § 11/1-c recognizes the right to know the third parties to whom personal data has been transferred. Does transfer count as transmission in this context? Looking at Authority decisions:
- A package transfer within the same professional group (CPA → CPA), for the same purpose (accountancy service), with the customer's consent, has been treated by the Authority as "designation of a new data controller" and falls under the § 5/2-c (contractual performance) exemption.
- However, the identity of the new data controller must be explicitly notified in the Privacy Notice — which is why PratikYedek's automatic re-signing flow in step 5 is mandatory.
"Accountant is retiring, doesn't want to transfer — delete everything" scenario
Some accountants want to close their taxpayer portfolio at retirement and delete all data. In PratikYedek this is handled via the KVKK § 7 right to erasure flow:
- Taxpayer says "Delete my data"
- Audit-share retention period must have ended (otherwise legal retention applies and the system refuses)
- Deletion approval enters a 7-day cooling-off (the request might be accidental)
- After day 7 the hard-delete worker runs → all backups + audits + consents are deleted; only the "deletion approval itself" remains as an anonymous hash (who, when — KVKK § 12 proof)
Conclusion
Package transfer is a scenario most accountancy software ignores. Most providers say "no account migration, register again." PratikYedek treated this experience as a core primitive from the start because accountancy = the business of transfers.
In the Early Access program, we walk through this flow in 1:1 onboarding.