Under KVKK, Türkiye's data protection law, a cross-border data transfer means sending personal data to a recipient outside Türkiye or processing it on a server abroad. Since 1 June 2024 it needs a KVKK lawful basis plus an adequacy decision or a safeguard such as a standard contract; where neither exists, only the narrow incidental exceptions listed in the law remain. Explicit consent is no longer the main route.
You may be transferring data abroad without realising it
Most companies say "we don't transfer data abroad" — until they build an inventory. Corporate email turns out to be hosted in a data centre outside Türkiye, the CRM and accounting software are foreign cloud services, job applications arrive through an overseas platform, and staff paste documents into AI tools. The analytics and advertising scripts on the website send visitor data abroad, and backups may sit in storage in another country.
Each of these scenarios means personal data is held on, or accessed from, a system outside Türkiye, so each must be assessed under Article 9 of the law. The problem rarely stems from bad intent; it comes from purchasing decisions made without legal and IT sitting down together. We cover the overall compliance framework in KVKK compliance steps; this article focuses on cross-border transfers alone.
KVKK Article 9: what changed for transfers abroad in 2024?
According to the Turkish Data Protection Authority's page on transfers abroad, Article 9 of KVKK was amended by Law No. 7499, published in the Official Gazette on 12 March 2024, and the new rules took effect on 1 June 2024. The detailed procedures followed in a regulation published on 10 July 2024. Under the old regime, explicit consent was the route most companies relied on in practice; the new regime introduced a layered structure that will look familiar to anyone who knows the GDPR.
| Layer | When it applies | What to watch |
|---|---|---|
| Adequacy decision | The Board has issued a decision for the recipient country, a sector within it, or an international organisation | Decisions are reviewed every four years; check the Authority's site for the current list |
| Appropriate safeguards | No adequacy decision exists | Standard contract, binding corporate rules, written undertaking or an agreement between public bodies; data subjects must also be able to exercise their rights and have effective remedies |
| Incidental transfer | Neither adequacy nor safeguards, and the transfer is occasional and non-repetitive | Narrow exceptions such as explicit consent (after being told the risks), performance of a contract, or establishing a legal claim |
Under the adequacy and safeguard layers, the transfer must also rest on one of the processing conditions in Articles 5 or 6 of KVKK. In other words, you first answer "am I allowed to process this data at all?" and only then "which route lets me send it abroad?" Incidental transfers, by contrast, are limited to the narrow cases listed one by one in the law and cannot stand in for regular transfers.
The cost of getting it wrong: the Authority's 2025 figures
The new regime has not stayed on paper. According to the Turkish Data Protection Authority's 2025 Annual Report:
In 2025, 2,497 standard contracts were notified to the Authority, which opened ex officio reviews into 70 of them and concluded 21.
The written undertaking route is far narrower. The same report shows that of 90 undertakings submitted in 2025, 89 were reviewed and only 13 were approved, while 76 were refused. Of the 12,512 complaints and notices the Authority received that year, 105 concerned unlawful transfers of personal data abroad.
Uncertainty is shaping business decisions as well. In the Ministry of Trade's E-Commerce Outlook Report 2025 survey of 781 businesses, the biggest barriers to AI adoption were legal uncertainty (70.3%) and data privacy and security concerns (70.2%). Failing to notify a standard contract is also a separate administrative offence under the law, carrying its own fine.
What is a KVKK standard contract for transfers abroad, and how is it notified?
The standard contract is the most practical safeguard for transfers to countries without an adequacy decision. The texts announced by the Board come in four modules depending on the parties: controller to controller, controller to processor, processor to processor and processor to controller. The texts must be used unchanged; the parties only complete the annexes, which set out the data categories, purposes, recipients and technical and organisational measures.
According to the Authority's announcement on the Standard Contract Notification Module, the contract must be notified within five business days of the signatures being completed. Notification can be made physically, by registered e-mail (KEP, Türkiye's legally recognised electronic delivery system) or through the online module launched in October 2024. To avoid missing the deadline, give the same person responsibility for both signature and notification.
For corporate groups, the second option is binding corporate rules: a group of companies engaged in joint economic activity can, with Board approval, use a single set of rules for intra-group transfers. For a Turkish subsidiary that regularly sends employee or customer data to a parent company abroad, this can be easier to manage than many bilateral contracts.
A seven-step plan for KVKK cross-border data transfer compliance
- Build a transfer inventory. Add "where is it hosted, from which country is it accessed, which provider" columns to your personal data inventory. Question email, file storage, CRM, HR, accounting, backup, support tools, web analytics and AI tools one by one. How to assess transfers in AI projects is covered in AI and personal data protection.
- Establish the roles. Is the other party a processor (a cloud service processing on your behalf) or a controller processing for its own purposes (an overseas business partner)? The standard contract module is chosen by role. If the other party is a processor, you also need a data processing agreement, which we cover in a separate article.
- Match the lawful basis to the transfer route. For each transfer, record the Article 5 or 6 condition and the adequacy decision or safeguard you rely on. Note an incidental exception only for genuinely occasional transfers; do not rely on one for a regular transfer.
- Sign the contracts and notify within five business days. Keep the notification date and proof on file.
- Ask about onward transfers. Request in writing whether your provider passes data to sub-processors in other countries and which safeguard covers that.
- Update your privacy notices. Reflect recipient groups and purposes accurately in your privacy notices and in your VERBIS registration.
- Consider the alternative. For some data the cleanest answer is not to transfer at all: move to a service that hosts the data in Türkiye, or send only anonymised data abroad.
AI tools are the fastest-growing item on this list. Staff pasting documents and customer data into overseas chat tools is often a transfer that nobody records; we cover the risks and a usage policy in ChatGPT and company data security. An alternative that keeps data inside your organisation is described in RAG and enterprise LLMs.
Questions to ask before choosing a cloud service
Before signing up for a new email, file or software service, ask:
- In which countries and data centres is the data stored?
- From which country does the support team access it?
- What is the sub-processor list, and how are changes notified?
- Where are the backups kept?
- How is data returned and deleted when the service ends?
For the email side of these questions see how to choose business email, and for the budget side, cloud migration cost.
A breach at a provider abroad still concerns you as the controller: the law holds you jointly responsible with your processor for data security measures. You will find the notification process, and what to require from providers contractually, in KVKK data breach notification within 72 hours, and retention periods for archives held abroad in our data retention and disposal policy guide.
How we handle cross-border transfers at Digital Bridge
We treat cross-border transfer as both a legal and a technical question; compliance work that gets the contract right but does not know where the data actually goes is incomplete:
- Discovery and inventory. Through our data protection compliance service, we extend your personal data inventory with transfer columns and verify technically, with your IT team, which system sends data to which country.
- Technical verification. We review DNS records, email forwarding, backup destinations and third-party integrations from a cyber security perspective to uncover transfers nobody has recorded.
- Alternative architecture. For companies that want to reduce transfers, we plan where data should live, how to migrate and what it will cost through our cloud migration and infrastructure consultancy. For organisations that need AI, we design an enterprise LLM assistant that keeps data within the organisation's boundaries.
- Pilot and continuity. We start with the highest-risk transfer; once the contract, notification and privacy notice steps are complete, we build the checklist for future service purchases into your procurement process. For document flows, we design storage location from the outset in our document management system work.
We expect you to ask the same questions when you evaluate our own product family, Smart360. In Smart360, each organisation's data is kept in a separate database for each product, and documents and the mail archive sit in S3-compatible object storage. You can ask us for this information in writing to complete the "where, with which provider" column of your inventory.
Settings that could create a transfer also stay in your hands. SmartFiles business file management ships with Word, Excel and PowerPoint previews switched off by default, because they send the document to an external online viewer, and AI analysis can be switched off across the organisation; Smart360 products reach AI services not directly but through Smart360's central layer.
Next step
Prepare one table this week: list the cloud and software services you use, the country where each hosts your data, and whether a signed contract is in place. The empty cells are the first items on your compliance plan. To review the table together, get in touch. For more data protection guides, visit our Cyber Security & Compliance hub.
If you want to put your security measures on a recognised framework, ISO 27001 certification for SMEs is a good next read; for the basic technical controls, see our SME cyber security checklist.