Cross-Border Personal Data Transfers and Standard Contractual Clause Notification Duties Under KVKK Article 9
Amended Article 9 of Turkish Personal Data Protection Law No. 6698 (KVKK) and its implementing Regulation establish a three-tier hierarchy for cross-border transfers: adequacy decisions, appropriate safeguards (principally Board-issued Standard Contractual Clauses), and strictly occasional derogations. Executed Standard Contracts must be notified to the Authority within five business days of signature completion.
The Three-Tier Cross-Border Transfer Hierarchy
Following the amendment of Article 9 of Personal Data Protection Law No. 6698 ("KVKK") via Law No. 7499, Türkiye transitioned from an explicit-consent-centric model to a tiered framework aligned with the EU GDPR.
A lawful cross-border transfer first requires an underlying processing ground under Article 5 or Article 6 of KVKK, followed sequentially by: (i) an adequacy decision by the Board, (ii) appropriate safeguards in the absence of adequacy, or (iii) strictly occasional derogations where neither exists.
Standard Contractual Clauses and the Five-Business-Day Rule (KVKK Art. 9/4-c & 9/5)
The primary safeguard utilized by corporate controllers and processors is the execution—without textual modification—of one of the four Standard Contractual Clause (SCC) modules published by the Personal Data Protection Board.
Under Article 9(5), executed Standard Contracts must be notified to the Personal Data Protection Authority within five business days of signature completion via physical filing, Registered Electronic Mail (KEP), or the Authority's online notification module. Failure to notify triggers administrative fines under Article 18(1)(d).
Restriction of Explicit Consent to Occasional Transfers (KVKK Art. 9/6)
Explicit consent for cross-border transfers is now confined strictly to occasional (non-repetitive, outside ordinary operational flows) transfers. Continuous reliance on foreign cloud hosting, SaaS platforms, or global group servers cannot rest on consent alone and requires formal appropriate safeguards.
Statutory Questions & Practical Scope
Can parties modify the core clauses of the Board's Standard Contract?+
No. Under Article 14 of the Regulation, Standard Contractual Clauses issued by the Board must be executed without altering their operative text; only the annexes specifying data categories and security measures are completed.
When does the five-business-day notification clock start?+
The period commences following the date on which authorized signatories of both the data exporter and data importer have completed signing the instrument.
All content on this website has been prepared strictly for general informational purposes in accordance with Turkish Attorneyship Law No. 1136 and the Union of Turkish Bar Associations Prohibition of Advertising Regulation. Nothing herein constitutes legal advice or an offer to establish an attorney-client relationship.