TOOL · 04
Cross-Border Data Transfer Tool
Determine on which legal basis you may transfer personal data abroad under KVKK Art. 9 (amended by Law 7499) and the Regulation of 10 July 2024. Your answers never leave your device.
For information only; not legal advice. Specific transfers should be assessed individually.
FAQ
About cross-border data transfers
How can personal data be transferred abroad under Turkish law?
KVKK Art. 9 (amended by Law 7499) sets out a three-tier system: first, a Board adequacy decision for the destination country, sector or organisation; failing that, one of the appropriate safeguards (standard contract, binding corporate rules, written undertaking, or an agreement between public bodies); and failing those, only the incidental grounds in Art. 9(6). A processing condition under Art. 5 or 6 must also exist in every case.
Must the standard contract be notified to the Authority?
Yes. For transfers based on the standard contract, it must be notified to the Authority by the data controller or processor within 5 business days of signature.
Which countries have an adequacy decision?
Adequacy decisions are issued by the Board and published in the Official Gazette. As none has been published to date, transfers in practice usually rely on appropriate safeguards or incidental grounds.