(1) Personal data may be transferred abroad by controllers and processors under one of the conditions specified in Article 5 and Article 6 of the Law, and in the event of the following circumstances:

• a) An adequacy decision has been issued regarding the country, sectors within that country, or international organisations to which the transfer is to be made;
• b) In the absence of an adequacy decision, one of the appropriate safeguards specified in Article 10 is provided by the parties, on the condition that data subject rights and effective legal remedies for data subjects are also available in the country receiving the transfer.

(2) In the absence of an adequacy decision and where the parties cannot provide one of the appropriate safeguards specified in Article 10, personal data may be transferred abroad by controllers and processors only under one of the exceptional circumstances specified in Article 16, provided that such transfer is incidental.

(3) Without prejudice to the provisions of international conventions, personal data may only be transferred abroad with the permission of the Board by obtaining the opinion of the relevant public institution or organisation, in cases where the interests of Türkiye or the data subject would be seriously harmed.