SoSo CAD
RegulationFree to read2025

Guide on Transferring Personal Data Abroad (Kişisel Verilerin Yurt Dışına Aktarılması Rehberi)

Original title Kişisel Verilerin Yurt Dışına Aktarılması Rehberi

Kişisel Verileri Koruma Kurumu (KVKK)

KVKK's January 2025 guide explains the three-tier regime for transfers abroad in force since the 2024 amendments, and clarifies that remote access and storage in a foreign cloud also count as transfers.

Go to the original source
On this page

Overview

The guide is a publication of the Turkish Personal Data Protection Authority (KVKK), issued in January 2025 as KVKK Publication No. 48, explaining the rules on transferring personal data abroad. It describes to practitioners the new regime in force after the 2024 amendments. The regime has three tiers: transfers based on an adequacy decision, transfers based on appropriate safeguards, and exceptional transfers. Appropriate safeguards include non-treaty agreements, binding corporate rules, standard contracts and undertakings. Incidental exceptions form the last tier. The guide's table of contents covers the three tiers in Sections 5 to 7.

The most practically striking part is Section 4.A, which explains what counts as a transfer. Remote access from a third country, even display-only for support or administration, counts as a transfer when the definition's criteria are met. Under the same criteria, storage in a cloud located abroad offered by a service provider is also a transfer. Granting account access, approving a remote-access request or sending a file password are given as examples of making data accessible.

The record rests on the guide's summary; detailed conditions, application procedures and the standard contract text are not included. Law No. 6698 Article 9 and the KVKK Regulation on Transfers Abroad are recorded as related instruments. For designers and operators the significance is in recognising that support and administration processes may legally amount to transfers.

Key points

  1. Three tiers: adequacy-based transfers, appropriate-safeguard transfers and exceptional transfers (Sections 5-7).
  2. Remote access from a third country, even display-only for support or administration, counts as a transfer when the definition's criteria are met.
  3. Storage in a cloud located abroad offered by a service provider also counts as a transfer under the same criteria.
  4. Granting account access, approving a remote-access request or sending a file password are examples of making data accessible.
  5. Guide published January 2025 as KVKK Publication No. 48.
  6. Related instruments: Law No. 6698 Article 9 and the KVKK Regulation on Transfers Abroad.

Using it in design

  • Treat any foreign-located support engineer's remote session into a Turkish customer's SoSo CAD instance or DCIM as a transfer and gate it behind a standard-contract check.
  • Offer a TR-only support mode.
  • Treat storage in a foreign cloud as a transfer and document which tier it relies on.
  • Review access authorisation and password-sharing processes from the standpoint of making data accessible.

Monthly newsletter · free

Keep your reading list current

Once a month: new library sources, changes to Turkish regulations and upcoming data centre events.

SoSo CAD

Bring standards pre-checks into your project

Review model-based TS EN 50600 and Tier pre-checks, missing inputs and items requiring engineering review in SoSo CAD.

Request a demo
Selected rule packs and findings in the SoSo CAD standards panel

Who should read it

Software and cloud providers handling customer data in Turkey, data centre operators and compliance officers.

Related standards

  • 6698 sayılı Kanun Madde 9
  • KVKK Yurt Dışına Aktarım Yönetmeliği

Publication details

Authors
Kişisel Verileri Koruma Kurumu (KVKK)
Publisher
Kişisel Verileri Koruma Kurumu (KVKK)
Year
2025
Document number
KVKK Yayınları No: 48
Document language
Turkish
Source type
Turkish regulation
Access
Free to read
Licence
Copyright retained; citation only — the publisher’s terms apply to the original document
Original licence note

KVKK publication; booklet prohibits copying/distribution beyond personal use without permission (FSEK 5846). Citation only; PDF not redistributed.

Citation

Kişisel Verileri Koruma Kurumu (KVKK) (2025). Kişisel Verilerin Yurt Dışına Aktarılması Rehberi. Kişisel Verileri Koruma Kurumu (KVKK). KVKK Yayınları No: 48. https://www.kvkk.gov.tr/SharedFolderServer/CMSFiles/13711235-abb6-4b17-9a6b-0a68c1ad86c5.pdf

SecurityRegulatory

Events on this subject

Browse the events calendar

All content and rights belong to the respective authors and publishers. SoSo CAD provides only the citation, its own summary and a link to the source, and is not responsible for the sources' content.