Cross-Border Data Transfers
Cloud services, e-mail infrastructure, CRM software or group companies abroad: today most companies transfer personal data abroad without realising it. We identify your transfers, determine the appropriate transfer mechanism under the KVKK for each one, and run the standard contract process from signature to notification to the Authority.
What is a cross-border data transfer?
Sending personal data to a person established outside Türkiye, or making it accessible on a server abroad, is a transfer abroad. Uploading data to a cloud service hosted abroad, giving a foreign software provider access for support, or sharing employee information with a parent company abroad all fall within this scope.
Article 9 of the KVKK was rewritten by an amendment that entered into force on 1 June 2024. Transfers may first of all be made to countries covered by an adequacy decision of the Board. Where there is no adequacy decision, one of the appropriate safeguards must be provided, such as a standard contract, binding corporate rules or a written undertaking approved by the Board. Explicit consent is now only an exceptional route, available for occasional, non-recurring transfers.
What is a standard contract?
A standard contract is the contract text published by the Board, signed between the exporter and the recipient without modification. There are four separate texts depending on the parties’ roles: controller to controller, controller to processor, processor to processor and processor to controller. The signed contract must be notified to the Authority within five business days of signature.
Scope
- Designing processes for transferring data abroad
- Running standard contract processes
- Identifying the company’s transfers abroad and preparing a transfer inventory
- Determining the appropriate mechanism for each transfer and making notifications to the Authority
How We Work
- Identifying transfers abroad by reviewing the systems, service providers and intra-group data flows in use
- Determining the parties’ roles and the categories of data transferred in each transfer
- Choosing the transfer mechanism: standard contract, binding corporate rules or the exception for occasional transfers
- Completing the standard contracts, managing the signing process with the other party and notifying the Authority
- Updating privacy notices and the inventory to reflect the transfers
Team
Frequently Asked Questions
Does using a cloud service with servers abroad count as a transfer abroad?
Usually, yes. If data is stored on a server abroad or can be accessed by a provider abroad, there is a transfer. Services such as e-mail, file sharing, CRM and accounting software must therefore always appear in the transfer inventory.
Can we continue to transfer data abroad on the basis of explicit consent?
Only for occasional transfers, that is, transfers that are irregular and do not recur. Explicit consent can no longer be the basis for a cloud service in continuous use or a regular flow of data to a group company; those transfers require an appropriate safeguard such as a standard contract.
Can we change the text of the standard contract?
No. The standard contract is used exactly as published by the Board; only the blanks and annexes relating to the parties and the transfer are filled in. The parties may regulate commercial matters in a separate agreement, but those provisions must not conflict with the standard contract.
What happens if the standard contract is not notified to the Authority?
The KVKK provides for a separate administrative fine for breaching the five-business-day notification obligation. The signature date should therefore be tracked and the notification made as soon as the contract is signed.
Would you like to discuss this service? Schedule a meeting with us — the first meeting is free of charge.
Schedule a meetingPublications in this area
- Rights Over a Person’s Image and Photograph 15.10.2024
- Can the Corporate E-mail Histories of Employees Who Leave Their Jobs Be Made Available to Another Employee? – An Evaluation in the Context of the Law on the Protection of Personal Data 06.05.2024
- Deepfake Technology – Legal Challenges and Key Questions 17.11.2023
- Push Notifications in Turkish Law: Legal Obligations and User Rights 25.10.2023