---
title: "Cross-Border Personal Data Transfers and Standard Contractual Clause Notification Duties Under KVKK Article 9"
author: "Av. Mücahit Cahar Çağlayan"
reviewed_by: "Av. Mücahit Cahar Çağlayan"
publisher: "YCC Attorney Partnership"
jurisdiction: "TR"
language: "en"
published_at: "2026-10-29T10:30:00.000Z"
updated_at: "2026-10-29T10:30:00.000Z"
canonical_url: "https://ycc.cglndev.com/en/yayinlar/cross-border-personal-data-transfers-and-standard-contractual-clauses-under-kvkk-article-9"
---
# Cross-Border Personal Data Transfers and Standard Contractual Clause Notification Duties Under KVKK Article 9
> **Executive Summary:** Amended Article 9 of Turkish Personal Data Protection Law No. 6698 (KVKK) and its implementing Regulation establish a three-tier hierarchy for cross-border transfers: adequacy decisions, appropriate safeguards (principally Board-issued Standard Contractual Clauses), and strictly occasional derogations. Executed Standard Contracts must be notified to the Authority within five business days of signature completion.

## Referenced Legislation
- **6698 sayılı Kişisel Verilerin Korunması Kanunu** — m. 5, m. 6, m. 9, m. 18/1-d
- **Kişisel Verilerin Yurt Dışına Aktarılmasına İlişkin Usul ve Esaslar Hakkında Yönetmelik** — m. 14 (10.07.2024 tarihli ve 32598 sayılı Resmî Gazete)

## The Three-Tier Cross-Border Transfer Hierarchy

Following the amendment of Article 9 of Personal Data Protection Law No. 6698 ("KVKK") via Law No. 7499, Türkiye transitioned from an explicit-consent-centric model to a tiered framework aligned with the EU GDPR.

A lawful cross-border transfer first requires an underlying processing ground under Article 5 or Article 6 of KVKK, followed sequentially by: (i) an adequacy decision by the Board, (ii) appropriate safeguards in the absence of adequacy, or (iii) strictly occasional derogations where neither exists.

## Standard Contractual Clauses and the Five-Business-Day Rule (KVKK Art. 9/4-c & 9/5)

The primary safeguard utilized by corporate controllers and processors is the execution—without textual modification—of one of the four **Standard Contractual Clause (SCC)** modules published by the Personal Data Protection Board.

Under Article 9(5), executed Standard Contracts must be notified to the Personal Data Protection Authority **within five business days** of signature completion via physical filing, Registered Electronic Mail (KEP), or the Authority's online notification module. Failure to notify triggers administrative fines under Article 18(1)(d).

## Restriction of Explicit Consent to Occasional Transfers (KVKK Art. 9/6)

Explicit consent for cross-border transfers is now confined strictly to **occasional** (non-repetitive, outside ordinary operational flows) transfers. Continuous reliance on foreign cloud hosting, SaaS platforms, or global group servers cannot rest on consent alone and requires formal appropriate safeguards.

## Statutory Questions & Analysis

### Can parties modify the core clauses of the Board's Standard Contract?

No. Under Article 14 of the Regulation, Standard Contractual Clauses issued by the Board must be executed without altering their operative text; only the annexes specifying data categories and security measures are completed.

### When does the five-business-day notification clock start?

The period commences following the date on which authorized signatories of both the data exporter and data importer have completed signing the instrument.

---
*Informational legal assessment prepared by Av. Mücahit Cahar Çağlayan (YCC Attorney Partnership). Does not constitute individualized legal advice.*