(Amended: 2/3/2024- Art. 7499/34)

(1) Personal data may be transferred abroad by data controllers and data processors provided that one of the conditions set out in Article 5 and Article 6 is met and there is an adequacy decision regarding the country, sectors within that country, or international organizations to which the transfer will be made.

(2) The adequacy decision shall be issued by the Board and published in the Official Gazette. When deemed necessary, the Board may seek the opinion of relevant institutions and organizations. The adequacy decision shall be assessed at least every four years. Based on the assessment or in other circumstances it deems necessary, the Board may amend, suspend, or revoke the adequacy decision with prospective effect.

(3) When issuing an adequacy decision, the following elements shall be primarily taken into account:

• a) The reciprocity status concerning the transfer of personal data between Türkiye and the country, sectors within that country, or international organizations to which personal data will be transferred,
• b) The relevant legislation and practices of the country to which the personal data will be transferred, and the rules governing the international organization receiving the data transfer,
• c) The existence of an independent and effective data protection authority in the country to which personal data will be transferred or to which the international organization is subject, as well as the availability of administrative and judicial remedies,
• ç) Whether the country or international organization to which personal data will be transferred is a party to international conventions or a member of international organizations concerning personal data protection.
• d) The membership status of the country or international organization to which personal data will be transferred, in global or regional organizations to which Türkiye is a member.
• e) International conventions to which Türkiye is a party.

(4) In the absence of an adequacy decision, personal data may be transferred abroad by data controllers and data processors if one of the conditions specified in Article 5 and Article 6 is met and data subjects retain enforceable rights and effective legal remedies in the country to which the transfer is to be made, provided that one of the following appropriate safeguards is ensured:

• a) The existence of an agreement, which is not classified as an international convention, between public institutions and organizations or international organizations abroad and public institutions and organizations or professional organizations with public institution status in Türkiye, and the Board’s approval for the transfer;
• b) The existence of binding corporate rules approved by the Board containing provisions on personal data protection, which the companies within a group of undertakings engaged in joint economic activities are obliged to comply with;
• c) The existence of a standard contract published by the Board, containing information such as data categories, purposes of the data transfer, recipients and recipient groups, technical and organizational measures to be taken by the data importer, and additional measures for special categories of personal data;
• ç) The existence of a written commitment containing provisions to ensure adequate protection, and the Board’s approval for the transfer;

(5) The standard contract shall be notified to the Authority by the data controller or data processor within five business days following its signature.

(6) In the absence of an adequacy decision and where one of the appropriate safeguards specified paragraph four cannot be ensured, data controllers and data processors may transfer personal data abroad only under one of the circumstances specified below, provided that such transfer is incidental:

• a) The data subject has given explicit consent to the transfer, provided that he/she has been informed of the potential risks involved;
• b) The transfer is necessary for the performance of a contract between the data subject and data controller, or for the implementation of pre-contractual measures taken at the request of the data subject;
• c) The transfer is necessary for the establishment or performance of a contract between the data controller and another natural or legal person for the benefit of the data subject;
• ç) The transfer is necessary for an overriding public interest;
• d) The transfer of personal data is necessary for the establishment, exercise, or protection of any right;
• e) Transfer of personal data is necessary for the protection of life or physical integrity of a person himself/herself or of any other person, who is unable to provide consent due to physical disability or whose consent is not deemed legally valid;
• f) The transfer is made from a publicly accessible registry or a registry accessible to persons with legitimate interest, provided that the conditions for accessing the registry under relevant legislation are met, and that the person with a legitimate interest has requested the transfer.

(7) The provisions in subparagraphs (a), (b), and (c) of the sixth paragraph shall not apply to public law activities of public institutions and organizations.

(8) Data controllers and data processors shall ensure that the safeguards established under this Law, as well as the provisions of this Article, also apply to onward transfers of personal data that have been transferred abroad and transfers to international organizations.

(9) Without prejudice to international convention provisions, personal data may be transferred abroad only with the approval of the Board and after obtaining the opinion of the relevant public institution or organization, in cases where the interest of Türkiye or the data subject would be seriously harmed.

(10) Provisions of other laws concerning the transfer of personal data abroad are reserved.

(11) The procedures and principles for the implementation of this Article shall be regulated by a By-Law.