The New Regime for Cross-Border Data Transfers in Türkiye: What Should Companies Do?

Law No. 7499 comprehensively amended Article 9 of the Personal Data Protection Law No. 6698, and the new rules entered into force on 1 June 2024. The amendment offers a more predictable framework for cross-border transfers, which in practice previously relied largely on explicit consent.

Adequacy Decisions

Personal data may be transferred to countries, sectors or international organisations for which the Personal Data Protection Board has issued an adequacy decision, provided that one of the processing conditions in Article 5 or 6 exists.

Appropriate Safeguards

In the absence of an adequacy decision, data may be transferred where an appropriate safeguard is provided, such as binding corporate rules, standard contracts announced by the Board or written undertakings approved by the Board. Standard contracts must be notified to the Authority within five business days of signature.

Occasional Transfers

Where neither an adequacy decision nor appropriate safeguards exist, transfers are only possible occasionally and in limited cases listed in the law (such as explicit consent or necessity for the performance of a contract). This route should not be used for regular and systematic transfers.

Action Points

Companies should record transfers made through cloud services, email infrastructure, CRM systems and group companies in their inventory, determine the appropriate transfer mechanism for each and update their contracts accordingly.