A cross-border data transfer is the transmission of personal data across national borders — for example, to a cloud provider or group company abroad. Because the receiving country may offer weaker protection, data-protection laws permit such transfers only under defined safeguards.
Under the EU GDPR, transfers rely on adequacy decisions, Standard Contractual Clauses or binding corporate rules. In Türkiye, the KVKK regime — substantially amended in 2024 — now allows transfers based on an adequacy decision, appropriate safeguards (including standard contracts notified to the Authority) or specified exceptions, replacing the earlier explicit-consent-heavy model.
Türkiye’s 2024 cross-border transfer regime
Türkiye substantially overhauled its rules on transferring personal data abroad in 2024, moving much closer to the GDPR model. Transfers may now rely on one of three routes: (i) an adequacy decision for the destination country, sector or international organisation; (ii) appropriate safeguards — standard contractual clauses, binding corporate rules, or written undertakings approved by the Authority; or (iii) narrow, case-by-case derogations, including the data subject’s explicit consent for a specific transfer. This replaced the earlier framework that, in practice, pushed most exporters toward explicit consent or hard-to-obtain undertakings. Organisations sending data offshore should map their data flows, select and document the correct mechanism for each, and file standard contractual clauses with the Authority within the required period.
The Turkish transfer regime in practice
Türkiye’s cross-border transfer rules were rebuilt in 2024: alongside adequacy decisions (none broadly granted yet) and undertakings, the workhorse is now the KVKK standard contract — signed between exporter and importer and notified to the Board within five business days, a deadline with administrative-fine teeth. The practical program: inventory outbound flows (cloud, SaaS, group companies), select the mechanism per flow, execute standard contracts with accurate annexes, calendar the notifications, and remember GDPR may apply in parallel to the same flow — the SCC and the Turkish standard contract then coexist. Diligence on Turkish targets now routinely samples transfer paperwork; missing notifications is the new easy finding.
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro call