(1) The Board may decide that a country, one and more sectors within that country, or an international organisation offers an adequate level of protection with respect to the transfer of personal data abroad. When assessing the adequacy of the level of protection, the following elements shall be taken into account:

• a) The reciprocity status concerning the transfer of personal data between Türkiye and the country, sectors within that country, or international organisations to which the data will be transferred;
• b) The relevant legislation and practices of the country receiving the data transfer, and the rules governing the international organisation receiving the data transfer;
• c) The existence of an independent and effective data protection authority in the country or to which an international organisation is subject, as well as the availability of administrative and judicial redress for the data subjects;
• ç) The status of being a party to relevant international conventions on personal data protection or membership in international organisations by the country or international organisation to which the personal data will be transferred;
• d) The membership status of the country or international organisation receiving the data transfer in global or regional organisations that Türkiye is a member of;
• e) The international conventions to which Türkiye is a party.

(2) The Board shall be authorised to determine additional factors beyond those specified in the first paragraph.

(3) If the Board deems it necessary in its assessment regarding the adequacy decision, it may seek the opinions of relevant institutions and organisations.

(4) Adequacy decisions issued by the Board shall be published in the Official Gazette and on the Authority’s website.