TurkeyPersonal Data Protection Law (KVKK), cross-border transfer
Law No. 6698, Art. 9, as amended by Law No. 7499 (), Provisional Art. 3
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app transferring the personal data of a person in Turkey to a recipient outside Turkey must rely on a Board adequacy decision for the destination, or, absent one, on Board-approved binding corporate rules, a Board-published standard contract notified to the Authority within 5 business days of signature, a Board-approved written commitment, or an applicable international convention.
These lines are LexLint's reading of the law's text. Also read by: Kişisel Verileri Koruma Kurumu (Personal Data Protection Authority of Türkiye), Kişisel Verilerin Yurt Dışına Aktarılması Rehberi (Guide on the Transfer of Personal Data Abroad), KVKK Publication No. 48, January 2025 (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.kvkk.gov.tr/Icerik/8142/Kisisel-Verilerin-Yurt-Disina-Aktarilmasi-Rehberi
- Guidance body
- Kişisel Verileri Koruma Kurumu (Personal Data Protection Authority of Türkiye), Kişisel Verilerin Yurt Dışına Aktarılması Rehberi (Guide on the Transfer of Personal Data Abroad), KVKK Publication No. 48, January 2025
- Open questions
- When is the interest of Türkiye or of the data subject seriously harmed (menfaatinin ciddi bir şekilde zarar göreceği, "the interest would be seriously harmed"), so that Article 9(9) requires the Board's approval and the opinion of the relevant public body before a transfer abroad?
What it makes you log
Logging duty
Article 9 permits transfer abroad on an adequacy decision, on listed safeguards (including a standard contract, which must be notified to the Authority within five business days of signature, paragraph 5) or in listed incidental cases. It is a duty to notify the Authority of a signed standard contract; it names no record or log, no retention period and no inspector. Provisional Article 3 only keeps the earlier text of paragraph 1 in force until .
- Kind
- None
- As of
What this law does
Post-2024 Art. 9 requires an Art. 5/6 lawful basis for the underlying processing plus a cross-border mechanism: a Board adequacy decision published in the Official Gazette for the destination, or, absent adequacy, Board-approved binding corporate rules, a Board-published standard contract, a Board-approved written commitment, or an international convention Turkey is party to.
A party relying on the standard-contract route must notify the Authority within 5 business days of signature (Art. 9(5)); failure carries its own fine tier added by the 2024 amendment. Law No. 7499 brought the amended Article 9 into force on . Provisional Article 3 kept the first paragraph of Article 9, as it stood before the amendment, in effect alongside the amended text until , so the adequacy-first regime is the sole operative one from that date. No data localization is compelled.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .