Article 9 - Transfer of personal data abroad

(1) Personal data may be transferred abroad by data controllers and data processors if one of the conditions specified in Articles 5 and 6 is met and an adequacy decision exists concerning the country, sectors within that country, or international organizations where the data is to be transferred.

(2) The adequacy decision is issued by the Board and published in the Official Gazette. The Board may seek the opinions of relevant institutions and organizations if needed. The adequacy decision is reviewed at least every four years. The Board may amend, suspend, or revoke the adequacy decision for future transfers based on the review or in other necessary cases.

(3) When issuing an adequacy decision, the following considerations are prioritized:

• a) The reciprocity of personal data transfers between Türkiye and the country, sectors within the country, or international organizations to which the data will be transferred.
• b) The relevant legislation and practices of the country to which the personal data will be transferred or the rules to which the international organization is subject.
• c) The existence of an independent and effective data protection authority in the country where the personal data will be transferred, or the presence of administrative and judicial remedies.
• ç) Whether the country or international organization to which personal data will be transferred is a party to international agreements or a member of international organizations concerning data protection.
• d) Whether the country or international organization is a member of global or regional organizations to which Türkiye is also a member.
• e) International agreements to which Türkiye is a party.

(4) In the absence of an adequacy decision, personal data may be transferred abroad by data controllers and data processors if one of the conditions specified in Articles 5 and 6 is met, the data subject can exercise their rights and access effective legal remedies in the recipient country, and one of the following appropriate safeguards is provided by the parties:

• a) The existence of a non-international agreement between public institutions and organizations abroad or international organizations and Turkish public institutions or professional organizations with public institution status, and the transfer is permitted by the Board.
• b) Binding corporate rules that include provisions for personal data protection, which must be followed by companies within a group engaged in joint economic activities and approved by the Board.
• c) A standard contract published by the Board, covering data categories, transfer purposes, recipient and recipient groups, technical and administrative measures taken by the data recipient, and additional measures for special categories of personal data.
• ç) A written commitment that includes provisions ensuring adequate protection, and the transfer is permitted by the Board.

(5) The standard contract must be notified to the Authority by the data controller or data processor within five business days of signing.

(6) In the absence of an adequacy decision and if none of the appropriate safeguards specified in paragraph four are provided, personal data may only be transferred abroad on an incidental basis if one of the following conditions is met:

• a) The data subject has given explicit consent for the transfer after being informed of potential risks.
• b) The transfer is necessary for the performance of a contract between the data subject and the data controller or for pre-contractual measures taken at the data subject's request.
• c) The transfer is necessary for the establishment or performance of a contract made in the interest of the data subject between the data controller and another natural or legal person.
• ç) The transfer is necessary for an overriding public interest.
• d) The transfer of personal data is necessary for the establishment, exercise, or protection of a legal right.
• e) The transfer of personal data is necessary to protect the life or physical integrity of the data subject or another person who is unable to give consent due to actual impossibility or whose consent is legally invalid.
• f) The transfer is made from a registry that is publicly available or open to legitimate interests, provided the conditions for accessing the registry in the relevant legislation are met and the transfer is requested by a legitimate interest party.

(7) Paragraphs (a), (b), and (c) of paragraph six do not apply to the public law activities of public institutions and organizations.

(8) The safeguards in this Law must be provided for subsequent transfers of personal data abroad and for transfers to international organizations by data controllers and data processors, and the provisions of this article apply.

(9) Without prejudice to international agreements, personal data may only be transferred abroad with the permission of the Board after consulting the relevant public institution or organization if there is a substantial risk of serious harm to the interests of Türkiye or the data subject.

(10) Provisions of other laws on the transfer of personal data abroad remain in effect.

(11) The procedures and principles regarding the application of this article shall be regulated by regulation.