(1) Personal data may only be transferred abroad by the controller and the processor in accordance with the procedures and principles set forth in the Law and this ByLaw. In cases where personal data is transferred by the processor, the instructions from the controller shall also be complied with.

(2) The provision of the first paragraph shall also apply to onward transfers of personal data that has been transferred abroad, and transfers to international organisations.

(3) The provisions of other laws concerning the transfer of personal data abroad are reserved.

(1) Personal data may be transferred abroad by controllers and processors under one of the conditions specified in Article 5 and Article 6 of the Law, and in the event of the following circumstances:

• a) An adequacy decision has been issued regarding the country, sectors within that country, or international organisations to which the transfer is to be made;
• b) In the absence of an adequacy decision, one of the appropriate safeguards specified in Article 10 is provided by the parties, on the condition that data subject rights and effective legal remedies for data subjects are also available in the country receiving the transfer.

(2) In the absence of an adequacy decision and where the parties cannot provide one of the appropriate safeguards specified in Article 10, personal data may be transferred abroad by controllers and processors only under one of the exceptional circumstances specified in Article 16, provided that such transfer is incidental.

(3) Without prejudice to the provisions of international conventions, personal data may only be transferred abroad with the permission of the Board by obtaining the opinion of the relevant public institution or organisation, in cases where the interests of Türkiye or the data subject would be seriously harmed.

(1) In cases where personal data is transferred abroad by the processor, the processor shall act within the purpose and scope established by the controller, on behalf of the controller, and in accordance with the controller’s instructions. The processor shall implement all necessary technical and organisational measures to ensure an appropriate level of security, corresponding to the nature of personal data, in order to prevent unlawful processing of personal data, unlawful access to personal data, and to ensure protection of personal data.

(2) The transfer of personal data abroad by the processor shall not relieve the controller of its responsibility to comply with the procedures and principles, and to ensure the necessary safeguards stipulated in the Law and this By-Law. The controller shall be obliged to ensure that the technical and organisational measures specified in the first paragraph are implemented by the processor.

(3) If the processor is obliged to notify the standard contract pursuant to the Article 14(5), the processor shall fulfil this notification obligation independently of any instructions from the controller.