Cross-Border Data Transfer

A cross-border data transfer occurs when a data controller or processor subject to the KVKK sends personal data to, or makes it accessible by, a recipient outside Turkey. Article 9 of the KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, which entered into force in 2024, make such transfers subject to specific conditions.

What Counts as a Transfer?

Three elements must be present together: the exporting party must be subject to the KVKK, it must send the data to a third party or make it accessible, and the recipient must be located outside Turkey. Storing data on a cloud service abroad or giving a group company abroad access to a system is also a transfer. By contrast, sharing between two companies established in Turkey is not a cross-border transfer, even if one of them has foreign shareholders.

Transfer Mechanisms

Since the 2024 amendment, the following mechanisms apply in order:

1. Adequacy decision: A decision by the Board that the country, a sector within that country or an international organisation to which data will be transferred provides adequate protection. The adequacy decisions announced by the Board should be checked before transferring.
2. Appropriate safeguards: Where there is no adequacy decision and data subjects can exercise their rights: standard contractual clauses, binding corporate rules approved by the Board, a written undertaking authorised by the Board, or international agreements between public bodies. In practice, the vast majority of transfers are based on standard contractual clauses.
3. Occasional transfers: Where there is neither an adequacy decision nor appropriate safeguards, only occasional transfers, meaning those that are not regular and fall outside the normal course of business, may be made, and only in the limited cases listed in the Law, such as explicit consent, performance of a contract or the protection of a right.

Explicit Consent Is No Longer Enough

Before the amendment, the most common method was to obtain transfer-specific explicit consent from individuals. Today, regular transfers cannot be based on explicit consent; consent is an option only for occasional transfers. Companies still transferring data on the basis of old consent forms need to update their transfer mechanisms and privacy notices.

Sanctions

Transfers abroad in breach of the KVKK are subject, as a breach of data security obligations, to administrative fines increased every year. Failing to notify standard contractual clauses to the Authority on time is subject to a separate administrative fine.