Transfer of Personal Data Abroad
TRANSFER OF PERSONAL DATA ABROAD
Introduction
The transfer of personal data abroad is of critical importance in terms of protecting individuals’ right to privacy and ensuring data security. The regulations introduced in this scope aim, on the one hand, to safeguard the fundamental rights and freedoms of data subjects, and on the other hand, to ensure that international data flows are carried out within a lawful and foreseeable framework.
With the amendments made to Article 9 of the Personal Data Protection Law No. 6698 (“KVKK” and/or the “Law”) by Law No. 7499 in 2024, and the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad (“Regulation”) published in the Official Gazette dated 10.07.2024 and numbered 32598, the regime for transfers abroad has been restructured in line with the objective of harmonization with the European Union General Data Protection Regulation (GDPR). As of 01.09.2024, the transition period has been completed; instead of consent-based, continuous transfers, a three-tier system based on adequacy decisions – appropriate safeguards – occasional/exceptional cases has been adopted.
Conditions for the Transfer of Personal Data Abroad
Pursuant to Article 9 of the KVKK and the aforementioned Regulation, in order to transfer personal data abroad, at least one of the processing conditions set out in Articles 5 and 6 of the Law must first be present, and then one of the following three methods must be satisfied:
Existence of an Adequacy Decision
If one of the conditions specified in Articles 5 and 6 of the Law is met, it should first be checked whether there is an adequacy decision regarding the country, sectors in that country, or international organizations to which the data will be transferred. Adequacy decisions may be issued not only for an entire country but also for specific sectors. For example, by issuing an adequacy decision for a foreign country operating in the automotive sector, commercial cooperation may be facilitated. Thus, transfers of data to the relevant country/sector or organization can be carried out without the need for an additional safeguard mechanism.
Existence of Appropriate Safeguards
In cases where there is no adequacy decision, provided that one of the conditions set out in Articles 5 and 6 of the Law is met, and on the condition that rights are protected and effective legal remedies are available in the country to which the data will be transferred, it is possible to transfer data abroad if appropriate safeguards (agreement, binding corporate rules, standard contracts, written undertaking) are in place:
- Agreements signed between public institutions and organizations or professional organizations having the status of public institutions in Türkiye and public institutions and organizations or international organizations abroad, which are deemed appropriate for transfer by the Board,
- Binding corporate rules approved by the Board for groups of undertakings engaged in joint economic activity,
- Standard contracts with content announced by the Personal Data Protection Board (“Board”),
- Written undertakings containing provisions that ensure adequate protection and that become valid with the permission of the Board
Existence of Exceptional (Occasional) Transfer Cases
In cases where neither an adequacy decision nor appropriate safeguards are available, data transfer may be carried out for occasional (one-off or non-continuous) transfers if one of the exceptional cases set out in Paragraph 6 of Article 9 of the Law exists.
Law No. 7499 also includes certain exceptions regarding the activities of public institutions and organizations. In addition, provisions in other laws and international conventions to which Türkiye is a party should also be taken into account in data transfers.
Conditions for the Processing of Personal Data Within the Scope of Articles 5 and 6 of the KVKK
With regard to the transfer of personal data abroad, not only Article 9 of the Law but also Articles 5 and 6, which regulate the conditions for the processing of personal data and special categories of personal data, must be considered. If one of the conditions specified in the relevant articles exists and other conditions (adequacy decision, appropriate safeguard) are met, personal data may be transferred abroad. At this point, if the transfer abroad is on the agenda, it is beneficial to primarily examine Articles 5 and 6 of the Law.
Conclusion and Evaluation
The transfer of personal data abroad is a matter of strategic importance in terms of protecting individual rights and freedoms as well as ensuring the sustainability of international trade, digital services, and technology-oriented business models. With the amendments made in 2024, and the Guide on the Transfer of Personal Data Abroad published in January 2025, the regime regarding the transfer of data abroad in Türkiye has been structured around adequacy decisions, appropriate safeguards, and occasional/exceptional cases, thereby achieving a more predictable, risk-based, and GDPR-compliant framework.
Sincerely,
Atabay Law Office