Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad (Kişisel Verilerin Yurt Dışına Aktarılmasına İlişkin Usul ve Esaslar Hakkında Yönetmelik)

Overview

This regulation, issued by the Personal Data Protection Authority (KVKK), sets the procedures and principles for applying Article 9 of Law 6698 on transfers of personal data abroad (Article 1(1)). It requires transfers by controllers and processors to follow the Law and the regulation; the rules also apply to onward transfers and transfers to international organisations.

Transfers by processors must additionally follow the controller's instructions (Article 5). Among the safeguard tools, the regulation sets two main rules. Binding corporate rules must contain at least items such as group structure and contacts, data categories, purposes, data subjects and destination countries (Article 13(1)). Standard contracts are published by the Board and must be used without any modification (Article 14(2)-(3)).

Exceptional transfers are possible only for incidental cases, meaning non-regular, one-off and non-continuous ones, when no adequacy decision or safeguard is available (Article 16(1)). This shows that routine, ongoing transfers cannot rely on the exception. Related documents include Article 9 of the Law and the KVKK Guide on Cross-Border Transfers. This page is not legal advice and does not replace the official text.

Key points

1. Purpose: procedures for applying Article 9 of Law 6698 on transfers of personal data abroad (Article 1(1)).
2. Transfers by processors must also follow the controller's instructions.
3. The rules also apply to onward transfers and transfers to international organisations (Article 5(1)-(2)).
4. Binding corporate rules must contain at least group structure and contacts, data categories, purposes, data subjects and destination countries (Article 13(1)).
5. Standard contracts are published by the Board and must be used without modification (Article 14(2)-(3)).
6. Exceptional transfers are only for incidental (non-regular, one-off, non-continuous) cases (Article 16(1)).

Using it in design

• If SoSo CAD uses foreign sub-processors (cloud, email, monitoring), maintain an unmodified KVKK standard contract for each transfer path.
• Record the notification date for each standard contract.
• Do not rely on the 'incidental' exception for routine replication or backups abroad.
• Document data location and the sub-processor list in the SaaS architecture.

Who should read it

Legal and information-security teams of controllers and processors that provide SaaS and cloud services.

Related standards

• 6698 sayılı Kanun Madde 9
• KVKK Yurt Dışına Aktarım Rehberi

Publication details

Authors

Kişisel Verileri Koruma Kurumu (KVKK)

Publisher

Kişisel Verileri Koruma Kurumu (KVKK)

Year

2024

Document number

RG 32598 (10.07.2024)

Document language

Turkish

Source type

Turkish regulation

Access

Free to read

Licence

Bibliographic reference only — the document is not redistributed here; confirm reuse terms at the original source

Citation