Law note · Turkey

Personal Data Protection Law (KVKK), cross-border transfer

cite Law No. 6698, Art. 9, as amended by Law No. 7499 (2 March 2024), Provisional Art. 3 stage IN FORCE in force since 2024-09-01 kind Cross border transfer binds public and private bodies reviewed 2026-08-29

What it requires

An app transferring the personal data of a person in Turkey to a recipient outside Turkey must rely on a Board adequacy decision for the destination, or, absent one, on Board-approved binding corporate rules, a Board-published standard contract notified to the Authority within 5 business days of signature, a Board-approved written commitment, or an applicable international convention.

When LexLint raises it

crawls_web
trains_models
processes_biometrics
processes_voice

What we found

Post-2024 Art. 9 requires an Art. 5/6 lawful basis for the underlying processing plus a cross-border mechanism: a Board adequacy decision published in the Official Gazette for the destination, or, absent adequacy, Board-approved binding corporate rules, a Board-published standard contract, a Board-approved written commitment, or an international convention Turkey is party to.

A party relying on the standard-contract route must notify the Authority within 5 business days of signature (Art. 9(5)); failure carries its own fine tier added by the 2024 amendment. The pre-2024 near-blanket explicit-consent requirement remained in force in parallel until 1 September 2024 under Provisional Art. 3, so the amended, adequacy-first regime described here is genuinely in effect only from that date. No data localization is compelled.

Primary source

official statute text, KVKK Kurumu consolidated English translation

← Back to the example · Lint your app →