Law No. 7499, which entered into force in 2024, made a comprehensive amendment to Article 9 of the KVKK on transfers of personal data abroad, bringing it closer to the European Union model.
A three-tier structure
Adequacy decisions: Data may be transferred to countries, sectors or international organisations that the Board has found to offer adequate protection, provided a processing condition is met.
Appropriate safeguards: Without an adequacy decision, transfers are possible under safeguards such as binding corporate rules, the Board’s standard contracts or written undertakings. Standard contracts must be notified to the Board within five working days of signature.
Occasional transfers: Where neither route is available, transfers may be made in a limited number of exceptional cases, such as with the data subject’s explicit consent, provided they are occasional.
Explicit consent is no longer a basis for regular, repeated transfers.
What should companies do?
Identify where your cloud, email, CRM and software providers process data; sign standard contracts for those transfers, notify them on time and update your privacy notices.
Relevant legislation
- Personal Data Protection Law No. 6698, Art. 9 (as amended by Law No. 7499)
- Regulation on the Procedures and Principles for Transferring Personal Data Abroad
This article is for general information only and does not constitute legal advice. Please consult a lawyer about your specific circumstances.
