Personal Data Protection Law (KVKK), cross-border transfer

Law No. 6698, Art. 9, as amended by Law No. 7499 (2 March 2024), Provisional Art. 3

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 September 2024.

A cross border transfer rule binding public and private bodies.

As of 29 August 2026.

What it requires

An app transferring the personal data of a person in Turkey to a recipient outside Turkey must rely on a Board adequacy decision for the destination, or, absent one, on Board-approved binding corporate rules, a Board-published standard contract notified to the Authority within 5 business days of signature, a Board-approved written commitment, or an applicable international convention.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Post-2024 Art. 9 requires an Art. 5/6 lawful basis for the underlying processing plus a cross-border mechanism: a Board adequacy decision published in the Official Gazette for the destination, or, absent adequacy, Board-approved binding corporate rules, a Board-published standard contract, a Board-approved written commitment, or an international convention Turkey is party to.

A party relying on the standard-contract route must notify the Authority within 5 business days of signature (Art. 9(5)); failure carries its own fine tier added by the 2024 amendment. The pre-2024 near-blanket explicit-consent requirement remained in force in parallel until 1 September 2024 under Provisional Art. 3, so the amended, adequacy-first regime described here is genuinely in effect only from that date. No data localization is compelled.

When LexLint raises it

crawls_web
trains_models
processes_biometrics
processes_voice

Read the law

official statute text, KVKK Kurumu consolidated English translation

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app