Turkey KVKK Cross-Border Data Transfer Kit

§ 01 — The tiered model

Three routes, in order of preference.

The amended Article 9 no longer rests mainly on explicit consent. A transfer abroad is now assessed in a fixed order:

1 · Adequacy decision. If the Board has decided the destination country, sector or organisation provides adequate protection, transfer proceeds on that basis.
2 · Appropriate safeguards. Absent adequacy, the parties may rely on a standard contract (which must be notified to the Board within five business days), binding corporate rules approved by the Board, an international agreement between public authorities, or a written undertaking authorised by the Board.
3 · Exceptional cases. Only on an incidental, non-repetitive basis — for example explicit consent, performance of a contract, establishment or exercise of a legal claim, or a vital interest.

Registration in VERBİS and the general principles of Article 4 apply throughout. Explicit consent is now the exception, not the default route.

Which route, which condition.

Route	Condition	What it means in practice
Adequacy	Board decision	Transfer to a country/sector/organisation the Board has found adequate
Standard contract	Notify Board in 5 business days	Parties sign the Board form; failure to notify carries a fine
Binding corporate rules	Board approval	For intra-group transfers by multinational groups
International agreement	Public bodies	Between authorities, on a reciprocity basis
Written undertaking	Board authorisation	Case-specific undertaking authorised in advance
Exceptional cases	Incidental only	Explicit consent, contract, legal claim, vital interest — not routine
VERBİS	Registration	Data-controller registry obligations apply

Article 9 was amended by Law No. 7499; the transfer regime applies from 1 June 2024. Confirm the current text.

KVKK cross-border transfer decision — blank.

Copy the text below or download it as markdown. No sign-up.

TR-KVKK-09 · Version 1.0 · Free Download .md ↓

# KVKK — CROSS-BORDER TRANSFER DECISION RECORD

Document code: TR-KVKK-09 · Version 1.0 · Classification: Internal
Organisation: [NAME]   Prepared by: [NAME/ROLE]   Date: ……/……/20……
Reference: KVKK Art. 9 (amended by Law 7499; regime from 1 June 2024)

SECTION 1 — TRANSFER DESCRIPTION
Data categories: [……]   Special category? [ ] Y [ ] N
Data subjects: [……]   Purpose: [……]
Recipient / importer: [NAME]   Country: [……]
Repetitive or one-off? [ ] recurring  [ ] incidental

SECTION 2 — ROUTE SELECTION  (choose one, in order)
[ ] 1. Adequacy decision covers this destination — reference: ……
[ ] 2. Appropriate safeguard:
       [ ] Standard contract (Board form) — signed ……, notified to Board on ……
           (deadline: 5 business days from signature)
       [ ] Binding corporate rules — Board approval ref: ……
       [ ] International agreement (public bodies) — ref: ……
       [ ] Written undertaking — Board authorisation ref: ……
[ ] 3. Exceptional case (incidental only):
       [ ] explicit consent [ ] contract [ ] legal claim [ ] vital interest
       [ ] other: ……   — basis this is NOT recurring: ……

SECTION 3 — GENERAL COMPLIANCE
[ ] Article 4 principles met (purpose limitation, minimisation, accuracy)
[ ] Privacy notice covers the transfer
[ ] VERBİS registration current
[ ] Security measures appropriate (Art. 12)

SECTION 4 — RECORDS
Retain the signed instrument, Board notification/approval evidence and this
decision record.

Owner: [ROLE]   Review cycle: [PERIOD]   Next review: ……/……/20……

This template is general and does not constitute legal advice.

Three things the decision map does not settle for you.

Which route applies. Whether an adequacy decision covers your destination, and whether a standard contract or BCR is the right instrument, depends on the specific transfer.

The 5-day notification. Standard contracts must be notified to the Board within five business days of signing; missing it is itself a breach.

"Incidental". Exceptional-case routes only work for non-repetitive transfers; routine flows cannot be built on them.

Note This decision map is a general framework. Route selection, the standard-contract notification and whether a transfer is truly 'incidental' depend on your data flows and destinations; building routine transfers on an exceptional-case basis is a common and costly error. You can book a preliminary call to map your transfers and pick the right mechanism.

Questions.

When did Turkey's new cross-border transfer regime start?

The amended Article 9 (Law No. 7499) applies from 1 June 2024. It replaced the old explicit-consent-centred model with a tiered one.

Is explicit consent still enough on its own?

Only as an exceptional, incidental route — not for routine or recurring transfers. The primary routes are an adequacy decision and, failing that, appropriate safeguards such as the standard contract or binding corporate rules.

What is the deadline for the standard contract?

The signed standard contract must be notified to the Board within five business days of signature. Failing to notify is itself subject to an administrative fine.

Do we still register in VERBİS?

Data-controller registry (VERBİS) obligations continue to apply where relevant, alongside the transfer mechanism.

Sending personal data abroad? Article 9 changed in 2024.

Three routes, in order of preference.

Which route, which condition.

KVKK cross-border transfer decision — blank.

Three things the decision map does not settle for you.

Questions.

Read next.

Let's map your transfers to the right route.