Law No. 7499, published in the Official Gazette dated 12 March 2024 and numbered 32487, amended Article 9 of Law No. 6698 on the Protection of Personal Data, titled “Transfer of personal data abroad”. According to the announcement of the Personal Data Protection Authority, these amendments entered into force on 1 June 2024. A transitional period for the concurrent application of the old and new transfer provisions was envisaged until 1 September 2024.
The principal effect of the new system is that cross-border transfers should no longer be assessed through a single legal tool in every case. Instead, the nature of the transfer requires a staged analysis. The first questions for a controller or processor are which country receives the data, which data categories are transferred, for what purpose and on which legal basis.
The staged transfer logic
The Authority describes the cross-border transfer regime under three main headings. The first stage is whether an adequacy decision exists for the recipient country, a sector within that country or an international organisation. The second stage, where no adequacy decision exists, is whether one of the appropriate safeguards listed in the Law is provided. The third stage is the assessment of limited occasional-transfer exceptions where neither an adequacy decision nor appropriate safeguards are available.
In this framework, explicit consent has not disappeared from the system. However, it should not be treated as the ordinary basis for continuous, regular and structural data transfers. In particular, cloud services, intra-group data flows, outsourcing arrangements or recurring transfers to foreign suppliers require a separate assessment of whether the transfer is truly “occasional”.
Where no adequacy decision exists
Check the Board’s current decisions for an adequacy decision covering the recipient country, sector or organisation. If none applies, assess appropriate safeguards and the statutory conditions.
Appropriate safeguards include standard contracts, binding corporate rules, certain agreements subject to Board authorisation and undertakings. The Authority has announced that the Board adopted standard contract texts and documents concerning binding corporate rules by its decision dated 4 June 2024 and numbered 2024/959.
Practical assessment
The new regime does not reduce transfer compliance to the signing of a contract. The nature of the data, the purpose of transfer, the role of the recipient, technical and administrative measures, the ability of data subjects to exercise their rights and access to effective remedies should be assessed together.
- Data mapping: Identify which personal data leaves Turkey through which system or service provider.
- Role assessment: Determine whether the recipient acts as a controller or processor in the concrete relationship.
- Legal instrument: Identify whether an adequacy decision, an appropriate safeguard or an occasional-transfer exception may apply.
- Documentation: Align the transfer activity with privacy notices, contracts and internal policy documents.
In conclusion, the amendment to Article 9 of Law No. 6698 turns cross-border transfers into a more structured compliance process. Lawfulness depends not only on the parties’ intent, but on whether the statutory stages are satisfied in the specific case.
Frequently Asked Questions
Is explicit consent always sufficient?
Explicit consent is not the ordinary basis for continuous, regular transfers. The statutory sequence of adequacy, safeguards and limited exceptions must be assessed.
Is signing a standard contract sufficient on its own?
No. The data, parties’ roles, technical and organisational measures, privacy notices and documentation obligations must also be assessed.
What is the first practical step?
Map which personal data are transferred abroad through which systems, service providers or group companies before selecting the legal instrument.