Since 1 June 2024, KVKK Article 9 works on a tiered model: an adequacy decision first, then appropriate safeguards, then narrow exceptional cases. Below: a transfer decision map and a standard-contract checklist.
Download the templateThe amended Article 9 no longer rests mainly on explicit consent. A transfer abroad is now assessed in a fixed order:
Registration in VERBİS and the general principles of Article 4 apply throughout. Explicit consent is now the exception, not the default route.
| Route | Condition | What it means in practice |
|---|---|---|
| Adequacy | Board decision | Transfer to a country/sector/organisation the Board has found adequate |
| Standard contract | Notify Board in 5 business days | Parties sign the Board form; failure to notify carries a fine |
| Binding corporate rules | Board approval | For intra-group transfers by multinational groups |
| Agreement between public bodies | Board permission | Non-treaty agreement between foreign and Turkish public bodies (or international organisations / public professional organisations); the Board must permit the transfer |
| Written undertaking | Board authorisation | Case-specific undertaking authorised in advance |
| Exceptional cases | Incidental only | Explicit consent, contract, legal claim, vital interest — not routine |
| VERBİS | Registration | Data-controller registry obligations apply |
Article 9 was amended by Law No. 7499; the transfer regime applies from 1 June 2024. Confirm the current text.
Copy the text below or download it as markdown. No sign-up.
# KVKK — CROSS-BORDER TRANSFER DECISION RECORD
Document code: TR-KVKK-09 · Version 1.0 · Classification: Internal
Organisation: [NAME] Prepared by: [NAME/ROLE] Date: ……/……/20……
Reference: KVKK Art. 9 (amended by Law 7499; regime from 1 June 2024)
SECTION 1 — TRANSFER DESCRIPTION
Data categories: [……] Special category? [ ] Y [ ] N
Data subjects: [……] Purpose: [……]
Recipient / importer: [NAME] Country: [……]
Repetitive or one-off? [ ] recurring [ ] incidental
SECTION 2 — ROUTE SELECTION (choose one, in order)
[ ] 1. Adequacy decision covers this destination — reference: ……
[ ] 2. Appropriate safeguard:
[ ] Standard contract (Board form) — signed ……, notified to Board on ……
(deadline: 5 business days from signature)
[ ] Binding corporate rules — Board approval ref: ……
[ ] Non-treaty agreement between public bodies — Board permission ref: ……
[ ] Written undertaking — Board authorisation ref: ……
[ ] 3. Exceptional case (incidental only):
[ ] explicit consent [ ] contract [ ] legal claim [ ] vital interest
[ ] other: …… — basis this is NOT recurring: ……
SECTION 3 — GENERAL COMPLIANCE
[ ] Article 4 principles met (purpose limitation, minimisation, accuracy)
[ ] Privacy notice covers the transfer
[ ] VERBİS registration current
[ ] Security measures appropriate (Art. 12)
SECTION 4 — RECORDS
Retain the signed instrument, Board notification/approval evidence and this
decision record.
Owner: [ROLE] Review cycle: [PERIOD] Next review: ……/……/20……
This template is general and does not constitute legal advice.
The amended Article 9 (Law No. 7499) applies from 1 June 2024. It replaced the old explicit-consent-centred model with a tiered one.
Only as an exceptional, incidental route — not for routine or recurring transfers. The primary routes are an adequacy decision and, failing that, appropriate safeguards such as the standard contract or binding corporate rules.
The signed standard contract must be notified to the Board within five business days of signature. Failing to notify is itself subject to an administrative fine.
Data-controller registry (VERBİS) obligations continue to apply where relevant, alongside the transfer mechanism.