(1) In the absence of an adequacy decision, personal data may be transferred abroad on the condition that one of the conditions specified in Article 5 and Article 6 of the Law exists, and that data subject rights and effective legal remedies for data subjects are also available in the country receiving the transfer, but only where one of the following appropriate safeguards is provided by the parties involved in the transfer:

• a) The existence of an agreement, which is not classified as an international convention, between public institutions and organisations, or professional organisations with public institution status in Türkiye and public institutions, organisations, or international organisations abroad, along with approval for the transfer by the Board;
• b) The existence of binding corporate rules, containing provisions on personal data protection, which the companies within a group of undertakings engaged in joint economic activities are required to comply with, and which have been approved by the Board;
• c) The existence of a standard contract which is published by the Board, containing information such as data categories, purposes of the data transfer, recipients and recipient groups, technical and organisational measures to be implemented by the data importer, and additional measures for sensitive personal data,
• ç) The existence of a written commitment containing provisions to ensure adequate protections, and approval for the transfer by the Board.

(1) Appropriate safeguards may be provided by provisions to be inserted into agreements, not classified as an international convention, for the transfer of personal data between public institutions and organisations, or professional organisations with public institution status in Türkiye, and public institutions, organisations, or international organisations abroad. The agreement shall be concluded between the parties to the personal data transfer.

(2) The Board’s opinion shall be sought during the negotiation process of the agreement.

(3) The provisions on personal data protection included in the agreement shall specifically address the following:

• a) The purpose, scope, nature, and legal basis of the personal data transfer;
• b) Definitions of key concepts in accordance with the Law and relevant legislation;
• c) A commitment to comply with the general principles outlined in Article 4 of the Law,
• ç) Procedures and principles for providing information to data subjects about the agreement and the personal data transfer to be carried out under that agreement;
• d) A commitment to ensure that data subjects whose personal data has been transferred can exercise their rights as specified in Article 11 of the Law, and procedures and principles regarding the requests to be made for the use of these rights;
• e) A commitment to implement all necessary technical and organisational measures to ensure appropriate level of security;
• f) A commitment to implement adequate measures as determined by the Board for the transfer of sensitive data;
• g) Restrictions on the onward transfer of personal data; ğ) A redress mechanism available to data subjects in the event of a breach of the data protection provisions to be included in the agreement;
• h) An auditing mechanism to ensure compliance with the data protection provisions to be included the agreement;
• ı) A provision granting the data exporter the right to suspend the data transfer and terminate the agreement if the data importer cannot comply with the data protection provisions to be included in the agreement;
• i) A commitment from the data importer, upon termination or expiration of the agreement, to either return the personal data transferred, including all backups, to the data exporter or to completely destroy such data, at the choice of the data exporter;

(4) To transfer the personal data abroad based on the agreement, the data exporter shall apply to the Board for permission. As part of the application, the final version of the agreement text and any other information and documents necessary for the Board’s evaluation shall be submitted to the Board. The transfer of personal data may only commence after the Board has granted the permission.

(1) Appropriate safeguards may be provided through binding corporate rules for the protection of personal data, which the companies within the group of undertakings engaged in joint economic activity are obliged to comply with. To transfer personal data abroad based on binding corporate rules, an application for approval shall be submitted to the Board.

(2) As part of the application, the text of the binding corporate rules and any other information and documents necessary for the Board’s evaluation shall be submitted to the Board. If any document submitted for the application is in a foreign language, a notarised translation shall be attached to the application. If the binding corporate rules are also prepared in a foreign language, the Turkish text shall prevail.

(3) In approving the binding corporate rules, the Board shall consider the following:

• a) The binding corporate rules are legally binding and enforceable for each relevant member within the group of undertakings engaged in joint economic activity, including their employees;
• b) The binding corporate rules include a commitment to ensure enforceable data subject rights;
• c) The binding corporate rules contain at least the elements specified in Article 13.

(4) The transfer of personal data may only commence after the Board has approved the binding corporate rules.

(1) Binding corporate rules shall include at least the following elements:

• a) The organisational structure and contact details for each member of the group of undertakings engaged in a joint economic activity;
• b) Information regarding the data transfers under binding corporate rules, in particular the categories of personal data, processing activity and its purposes, data subject group or groups, and identification of country or countries receiving data transfer,
• c) A commitment confirming that binding corporate rules are legally binding both within the internal relations and external legal interactions of the group of undertakings engaged in a joint economic activity;
• ç) Data protection measures such as compliance with the general principles outlined in Article 4 of the Law, conditions for processing personal data, sensitive personal data, technical and organisational measures for ensuring data security, adequate measures for processing sensitive personal data, and restrictions on onward data transfers;
• d) A commitment to ensure that data subjects whose personal data is transferred can exercise of their rights specified in Article 11 of the Law and their right to lodge a complaint with the Board in accordance with the procedures and principles outlined in Article 14 of the Law, along with the existence of the procedures and principles for the exercise of these rights;
• e) A commitment that, in the event of a breach of the binding corporate rules by any member not established in Türkiye, a controller and/or processor established in Türkiye will assume liability for the breach;
• f) Explanations on how the data subjects will be informed about matters related to the binding corporate rules, in particular on the provisions referred to in subparagraphs (ç), (d) and (e), as well as the information provided to the data subjects within the scope of the obligation to inform under Article 10 of the Law;
• g) Explanations on the training to be provided to employees on the protection of personal data;
• ğ) The tasks of the persons or entities in charge of the monitoring compliance with the binding corporate rules within the group of undertakings, including their role in responding to the requests of the data subjects;
• h) The mechanisms for auditing and verifying compliance with the binding corporate rules within the group of undertakings, in particular data protection audits and methods for ensuring corrective actions to protect the rights of the data subjects, and a commitment that such results will be communicated to the person or entity referred to in subparagraph (ğ) and to the board of the controlling company within the relevant group of undertakings, and to the Board upon request;
• ı) The mechanisms for reporting and recording changes to the binding corporate rules and reporting those changes to the Board;
• i) The obligation to cooperate with the Authority to ensure compliance with the binding corporate rules by the members of the group of undertakings, in particular the submission of the results from the audit and verification activities referred to in subparagraph (h);
• j) With respect to personal data to be transferred under the binding corporate rules, a commitment by the members of the group of undertakings that there is no national regulation in the country or countries receiving the data transfer that contradicts the guarantees provided by the binding corporate rules, and mechanisms to notify the Board in case of a legislative change which likely to have a substantial adverse effect on these guarantees;
• k) A commitment to provide appropriate data protection training to personnel having permanent or regular access to personal data;

(2) The Board shall be authorised to determine additional requirements beyond those specified in the first paragraph. The documents required for the application of binding corporate rules shall be determined by the Board.

(1) Appropriate safeguards may be provided through a standard contract, which includes elements such as data categories, purposes of data transfer, recipient and recipient groups, technical and organisational measures to be implemented by the data importer, additional measures, and additional measures for sensitive personal data.

(2) The standard contract shall be determined and announced by the Board.

(3) The standard contract text shall be used without any modifications. In the event the standard contract is also concluded in a foreign language, the Turkish text shall prevail.

(4) The standard contract shall be concluded between the parties involved in the personal data transfer. It shall be signed by the parties to the transfer, or by persons authorised to represent and sign on behalf of the parties.

(5) The standard contract, after finalisation of the signatures, shall be notified to the Authority within five business days, either physically, through a registered electronic mail (KEP) address, or via other methods specified by the Board. The parties to the transfer may designate in the standard contract which party will fulfil the notification obligation. If no such agreement is made, the data exporter shall be responsible for notifying the Board.

(6) The notification shall include documents certifying that the signatories are authorised, along with notarised translations of any foreign language documents.

(7) If the standard contract text announced by the Board is modified, or if one or both parties to the transfer lack valid signatures in the standard contract, the Board shall conduct an examination in accordance with Article 15 of the Law.

(8) In the event of any change to the parties involved in the standard contract, or modifications to the information and explanations it contains, or if the standard contract is expired, the Board shall be notified in accordance with the procedure outlined in paragraph five.

(1) Appropriate safeguards for the protection of personal data may be provided through provisions included in a written commitment letter to be concluded between the parties involved in the transfer.

(2) The provisions related to the protection of personal data in the commitment letter shall specifically include the following:

• a) The purpose, scope, nature, and legal basis of the personal data transfer;
• b) Definitions of key concepts in accordance with the Law and relevant legislation;
• c) A commitment to comply with the general principles specified in Article 4 of the Law;
• ç) Procedures and principles for informing data subjects about the commitment letter and the personal data transfer to be made under its scope;
• d) A commitment to ensure that data subjects whose personal data has been transferred can exercise their rights as specified in Article 11 of the Law, and procedures and principles regarding the requests to be made for the use of these rights;
• e) A commitment to implement all necessary technical and organisational measures to ensure appropriate level of security;
• f) A commitment to implement adequate measures as determined by the Board for the transfer of sensitive data;
• g) Restrictions on the onward transfers of personal data;
• ğ) A redress mechanism available to data subjects in the event of a breach of the commitment letter;
• h) A commitment by the data importer to comply with the Board’s decisions and opinions regarding the processing of personal data subject to the transfer;
• ı) A provision stating that there is no national regulation that will cause the data importer to fail to comply with the commitment letter, and a commitment to notify the data exporter as soon as possible of any potential legislative changes that may lead to such a failure, and in such a case the data exporter shall have the right to suspend the data transfer and terminate the commitment letter;
• i) A provision confirming that if the data importer fails to ensure compliance with the commitment letter, the data exporter shall have the right to suspend the data transfer and terminate the commitment letter;
• j) A commitment that if the commitment letter is terminated or its term expires, the data importer shall, at the choice of the data exporter, either return the personal data with its backups to the data exporter or completely destroy the personal data;
• k) A commitment confirming that the commitment letter is subject to Turkish law and, in case of a dispute, Turkish courts shall have jurisdiction, and that the data importer agrees to recognise the jurisdiction of Turkish courts.

(3) To transfer personal data abroad based on the commitment letter, data exporter shall apply to the Board for permission. As part of the application, the commitment text and any other information and documents necessary for the Board’s evaluation shall be submitted to the Board. If the commitment is also concluded in a foreign language, the Turkish text shall prevail. The transfer of personal data may only commence after the Board has granted permission.