Adequacy Decision

An adequacy decision is, under Article 9 of the KVKK, the first route for cross-border data transfers. If the Personal Data Protection Board decides that the country, a specific sector in that country or an international organisation to which data will be transferred provides adequate protection, transfers to those recipients can be made without additional safeguards.

What Does the Board Assess?

Under the KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, the Board assesses reciprocity between Turkey and the country concerned, the country’s data protection legislation and practice, the existence of an independent and effective supervisory authority, the international conventions the country is party to and the organisations it is a member of, and the legal remedies available to data subjects. Decisions are reviewed at least every four years.

The 2024 amendment broadened the scope of adequacy decisions: they can now be made not only for a whole country but also for specific sectors within it or for international organisations. Adequacy decisions are published in the Official Gazette and on the Authority’s website.

Role in Practice

Although an adequacy decision is the easiest route, in practice most companies base their transfers on standard contractual clauses. When planning a transfer, first check the Board’s current adequacy decisions; if there is none for the recipient’s country or sector, choose one of the appropriate safeguards.

Not to Be Confused with EU Adequacy Decisions

Adequacy decisions adopted by the European Commission under the GDPR have no effect under the KVKK. A Commission adequacy decision for a country does not mean that a transfer from Turkey to that country complies with the KVKK. Conversely, since there is no Commission adequacy decision for Turkey, EU companies sending data to Turkey rely on the EU’s own safeguards; see GDPR.