12 February 2025
roadmap
türkiye
International data transfers from Türkiye
Personal data transfers outside Türkiye are regulated by Article 9 of the Law on the Protection of Personal Data No. 6698 (Turkish DPL). Until March 2024, such transfers can only be made to countries with adequate protection according to the Personal Data Protection Board or via an application to this Board by data controllers and processors. Since the law's enactment in 2016, the Board has not designated any countries as having adequate protection, meaning that data transfers have primarily relied on the explicit consent of data subjects.
But consent can be withdrawn at any time and may not always be obtained explicitly. In response, Article 9 was amended on 3 March 2024, followed by a Regulation published on 10 July 2024.
Under the revised Regulation, personal data may be transferred abroad if one of the conditions specified in Articles 5 and 6 of the Turkish DPL is met. There must also be either an adequacy decision, where the country or relevant sectors are recognised as providing adequate data protection, or suitable guarantees that the individual can exercise their rights and access effective legal remedies in the recipient country as outlined in Article 10 of the Regulation.
Transfers based on adequacy decisions
The Board may conclude that a country, specific sectors within a country, or an international organisation provides adequate protection for personal data. The criteria considered include the reciprocity of data transfer arrangements between Türkiye and the recipient country or organisation, the legal framework and practices regarding personal data in the recipient, the presence of an independent data protection authority, and the recipient's membership in international data protection treaties or bodies.
Transfers based on suitable guarantees
In the absence of an adequacy decision, personal data can still be transferred if the Board approves (i) a non-binding agreement existing between public institutions or international organisations and Turkish entities, (ii) binding corporate rules established within a group of companies engaged in joint economic activity, (iii) the use of standard contracts containing data protection clauses, or (iv) a written commitment ensuring adequate protection.
Exceptional transfers
The amendments permit exceptional transfers where neither an adequacy decision nor suitable guarantees are available, but only in non-routine transfers. Such exceptions require the data subject's explicit and informed consent.
author: Didem Kara
