WMS Data Compliance Along the Middle Corridor: What Decides Which Platforms Even Qualify

If you are evaluating a warehouse management system for a facility in Kazakhstan, Azerbaijan, or Turkey, data compliance is not a line item you check after you have picked a vendor – in one of these three countries, it can disqualify half your shortlist before you get to features or pricing. Our WMS Evaluation Matrix covers this as evaluation point six: data residency and regulatory fit. This guide goes deeper into what that actually means, country by country, for anyone running a warehouse along the Trans-Caspian International Transport Route – the Middle Corridor – that connects Kazakhstan, Azerbaijan, and Turkey to Europe.

The short version: one of these three countries requires your WMS database to physically sit inside its borders, full stop. The other two do not, but each has its own cross-border transfer rules and its own mandatory e-invoicing portal your WMS will eventually need to integrate with. Getting this wrong is not a configuration fix after go-live – it is a vendor-selection problem you need to resolve before signing.

This is a first-pass regulatory map built from public sources, not a legal opinion – confirm anything material with local counsel before go-live.

Kazakhstan: Where Cloud-Only WMS Platforms Get Disqualified

Kazakhstan takes the hardest line of the three, and it is the one most likely to eliminate a cloud-only WMS outright. Under Law No. 94-V “On Personal Data and Its Protection,” any database containing personal data of Kazakhstani residents – employee records, customer records, or operational records that identify a person – must sit on a server physically located inside Kazakhstan. A foreign cloud region that is merely reachable from Kazakhstan does not satisfy this. The server itself has to be in-country, and the database has to be registered with the regulator (the Ministry of Digital Development, Innovation and Aerospace Industry).

Can I use a cloud WMS in Kazakhstan? Only if the vendor supports an in-country or hybrid deployment. A cloud-only platform hosted entirely outside Kazakhstan does not meet the localisation requirement, no matter how strong its encryption or access controls are – this is a residency requirement, not a security one, and it is worth separating the two clearly when you are scoring vendors.

Cross-border transfer out of Kazakhstan is permitted only with the data subject’s written consent, or under an interstate agreement recognising the destination country as offering adequate protection, plus prior notification to the regulator. A copy of the data may leave the country, but the primary database has to stay local – transfer permission does not remove the localisation duty.

What is IS ESF, Kazakhstan’s e-invoice system? IS ESF (Electronic Invoice Information System), run by the State Revenue Committee, is the sole legal channel for e-invoicing – a mandatory pre-clearance model with no direct peer-to-peer or PEPPOL-style exchange permitted. Goods movement is tracked through the same platform’s SNT e-waybill module and a Virtual Warehouse pre-declaration module – both worth checking for native integration if your WMS handles outbound shipping documentation. From 1 January 2026, the mandate extends to non-VAT-registered businesses including forwarding agents, customs service providers, and international couriers.

If your WMS also touches inbound/outbound freight scheduling, note that axle and gross-weight limits are set nationally and vary by season, with single-axle loads above 8 tonnes seasonally restricted (roughly late March to early May). These do not match Western European standards.

Azerbaijan: No Server Mandate, But Transfer Rules Still Apply

Azerbaijan is a materially lighter regulatory environment for WMS deployment. Its Law “On Personal Data” No. 998-IIIQ is structured closer to GDPR – lawfulness, purpose limitation, data minimization, storage limitation – rather than mandating in-country servers. There is no blanket hard-localization rule here, which means a cloud-hosted WMS that would fail in Kazakhstan can generally operate in Azerbaijan.

Cross-border transfer is conditional rather than prohibited: allowed where the destination country offers adequate protection, the data subject gives explicit consent, or the transfer is contractually necessary. The main prohibition is transfers that could compromise national security or public order.

Azerbaijan e-invoice portal requirements: e-taxes.gov.az, run by the State Tax Service, has been mandatory since 2017 for VAT-registered entities and most commercial taxpayers. It runs a centralized, near-real-time “registration” model rather than Kazakhstan’s pre-clearance approach. Invoices are structured XML validated against the tax authority’s own schema (not EN 16931/Peppol) and authenticated via Asan Imza, the national mobile signature. If your WMS generates outbound delivery documentation, e-waybill notes run through this same portal.

On road transport, Azerbaijan’s axle and weight limits sit close to the European table as a UNECE reporting country – but still a distinct table to configure into any yard or dispatch module, not one to assume.

Turkey: GDPR-Aligned, With Two Turkey-Specific Traps

Turkey’s KVKK (Law No. 6698), materially amended in 2024 by Law No. 7499, is the lightest-touch of the three on data residency – there is no blanket server-in-country mandate, so most WMS platforms with standard cloud hosting will clear this bar. KVKK regulates how data moves across borders, not where it physically sits.

The catch is in the transfer mechanics. Turkey’s Standard Contractual Clauses are not the EU’s SCCs – they must use the Turkish Data Protection Authority’s own templates, the contract has to exist in Turkish with the Turkish text controlling in a conflict, and the executed SCC must be notified to the KVKK Board within 5 business days. That five-day window is flagged as the single most common source of 2026 penalties, so if your WMS vendor is processing Turkish warehouse data on servers outside Turkey, confirm someone on your side owns that notification step. Most controllers must also register in VERBIS.

Turkey e-invoice requirements 2026: Managed by GIB (the Revenue Administration) through the New Central Application, live since December 2024. It runs two tiers: e-Fatura for B2B/B2G once turnover crosses a threshold (as low as zero for hospitality), and e-Arsiv for everyone else. As of 1 January 2026, the TRY 3,000 e-Arsiv minimum was removed entirely, so in practice every invoice must now be issued electronically. e-Irsaliye (e-waybill) becomes mandatory above roughly TRY 10M turnover – worth checking against your WMS’s dispatch and shipping-document capabilities if your operation is near that threshold. Authentication runs through Mali Muhur, a TUBITAK-issued financial seal certificate.

For the transport-management side of a Turkey deployment – freight visibility, customs documentation, multi-modal handoffs into the broader Trans-Caspian route – see our dedicated guide to TMS software for the Middle Corridor, which covers the logistics and customs angle this WMS guide does not.

Side-by-Side: What Changes Your WMS Vendor Shortlist

Running a Warehouse Network Across All Three

If your operation spans a shared WMS backend across Kazakhstan, Azerbaijan, and Turkey, Kazakhstan’s localization requirement is the binding constraint on the whole architecture: Kazakhstan-linked warehouse data has to be partitioned to in-country infrastructure even if the rest of your network runs on a centralized cloud platform elsewhere. Azerbaijan and Turkey both permit lawful-basis cross-border processing, which is workable for a shared backend across those two – but Turkey’s Turkish-language SCC template and 5-business-day notification rule still needs a named operational owner on your team, not just your vendor’s.

There is also no single cross-border e-document standard across the three the way Peppol works inside the EU – each e-invoicing system is a closed, government-run channel, so a shipment or shipment record crossing all three borders needs separate portal submissions, not one unified document flowing through your WMS.

Frequently Asked Questions

Does Kazakhstan require servers to be located in-country for a WMS? Yes, for any database holding personal data of Kazakhstani residents – which includes most operational warehouse records tied to employees or customers. The server must be physically inside the country, not just accessible from it, and the database must be registered with the regulator.

Can I use a cloud WMS in Kazakhstan? Only if the platform supports in-country or hybrid deployment. This is a residency requirement, not a security one – strong encryption on a foreign server does not satisfy it.

Do I need different WMS deployment architecture for each Middle Corridor country? Effectively yes if Kazakhstan is one of your sites. Kazakhstan needs an in-country or hybrid deployment; Azerbaijan and Turkey can generally run on standard cloud hosting, though Turkey’s cross-border transfer paperwork (Turkish-language SCCs, 5-day notification) needs someone accountable for it.

Is data residency the same thing as data security? No. Security covers encryption, access control, and audit logging – most modern cloud WMS platforms handle this well. Residency is a legal requirement about where the physical server sits, and no amount of security compensates for failing to meet it where a mandate exists, as in Kazakhstan.

What is IS ESF, Kazakhstan’s e-invoice system? IS ESF (Electronic Invoice Information System) is Kazakhstan’s State Revenue Committee platform and the sole legal channel for e-invoicing – a mandatory pre-clearance model, unlike Azerbaijan’s or Turkey’s near-real-time registration approach.

Is Turkey’s data protection law similar to GDPR? Broadly yes, following the 2024 amendment, but Turkey uses its own SCC templates in Turkish and requires notifying the KVKK Board within 5 business days of executing one – a Turkey-specific step that trips up otherwise GDPR-compliant WMS vendors.