Corporate & Commercial
KVKK Cross-Border Data Transfers: 2026 Compliance Guide
Cross-border data transfers under KVKK now require adequacy decisions, SCCs or BCRs. Learn the 2026 rules, fines and duties for foreign firms in Turkey.
For multinational groups, technology companies and family offices operating in the Turkish market, moving personal data out of Türkiye is one of the most closely supervised compliance steps of 2026. Law No. 7499 of 2 March 2024 replaced Article 9 of Turkey's Personal Data Protection Law (Personal Data Protection Law No. 6698 (KVKK), the KVKK) with effect from 1 June 2024; its legislative rationale states that the new article was drafted on the basis of the relevant provisions of the EU's GDPR. The Turkish Data Protection Authority (KVKK) and its Board now supervise transfers abroad through adequacy decisions, standard contracts, binding corporate rules and a short list of incidental exceptions.
For foreign investors and C-level decision-makers, this is not a back-office IT concern. Any group that routes HR records to a parent company, hosts customer data on overseas servers, or lets an affiliate abroad log into Turkish systems is conducting a regulated transfer. Getting it wrong exposes the Turkish entity to administrative fines and to a Board order halting the data flow. This guide maps the framework so that boards can structure transfers defensibly rather than reactively.
Key Takeaways
Law No. 7499 replaced Article 9 of the KVKK with effect from 1 June 2024. Under Provisional Article 3, the old first paragraph (transfer abroad with explicit consent) continued to apply alongside the new text only until 1 September 2024.
Transfers must rest on an adequacy decision, an appropriate safeguard (standard contract, binding corporate rules, or a written undertaking or public-sector agreement with Board permission), or, for incidental transfers only, an exception in Article 9(6). The first two routes also need a processing condition under Article 5 or 6.
A standard contract must be used without any change, the Turkish text governs over any foreign-language version, and the contract must be notified to the Authority within five business days of signature.
Failing to notify a standard contract has its own fine band in Article 18(1)(d). Statutory fine limits are revalued every calendar year, so check the current figures.
Data controllers must register with VERBIS before processing begins unless a Board exemption covers them.
The 2026 Cross-Border Transfer Framework
Under the original Article 9, a transfer abroad needed the data subject's explicit consent unless the Board had found the destination adequate or had authorised a written undertaking given by the exporter and importer. The legislative rationale of Law No. 7499 records that, in practice, transfers had come to depend on collecting consent person by person. The reform replaced that bottleneck with a layered structure; the procedure is set out in the Regulation on the Procedures and Principles for Transferring Personal Data Abroad, published in the Official Gazette on 10 July 2024 (cited below as "Reg."). Identifying which layer applies to a data flow is the first decision in any corporate and commercial law compliance review.
Tier 1 — Adequacy Decisions
The KVKK Board may decide that a country, one or more sectors within a country, or an international organisation offers adequate protection. Where a decision covers the destination, the transfer still needs a processing condition under Article 5 or 6, but no further safeguard. Adequacy decisions are published in the Official Gazette, reviewed at least every four years, and may be amended, suspended or revoked with prospective effect (Art. 9(2)). Check the Official Gazette for the specific destination before assuming that a decision exists.
Tier 2 — Appropriate Safeguards
Absent an adequacy decision, a transfer may proceed where a processing condition under Article 5 or 6 is met, the data subject can exercise their rights and has access to effective remedies in the destination country, and the parties put an appropriate safeguard in place (Art. 9(4)). Standard contracts (often called SCCs) are the workhorse for most commercial groups because, unlike a written undertaking, they do not require the Board's permission before data move.
Tier 3 — Incidental Exceptions
Where no adequacy decision or safeguard is available, Article 9(6) permits a transfer only if it is incidental and fits a listed situation, including explicit consent after the data subject has been informed of the possible risks, necessity for a contract with the data subject, necessity for establishing, exercising or protecting a right, an overriding public interest, and protection of the life or bodily integrity of a person unable to consent. The Regulation treats as incidental a transfer that is irregular, happens once or a few times, is not continuous and is not part of the ordinary course of business (Reg. Art. 16(1)). These exceptions cannot carry a systematic data flow.
Comparing the Transfer Routes
The table sets the routes side by side, with the provisions of the Law and of the Regulation that govern each one.
| Route | Legal basis | Board involvement | Key condition |
|---|---|---|---|
| Adequacy decision | KVKK Art. 9(1)–(3); Reg. Arts. 8–9 | Board issues the decision; published in the Official Gazette | Processing condition under Art. 5 or 6 |
| Standard contract | KVKK Art. 9(4)(c) and 9(5); Reg. Art. 14 | No prior permission; the Board announces the text | Text used unchanged; notified within five business days |
| Binding corporate rules | KVKK Art. 9(4)(b); Reg. Arts. 12–13 | Board approval before transfers begin | Group engaged in joint economic activity |
| Written undertaking | KVKK Art. 9(4)(ç); Reg. Art. 15 | Board permission before transfers begin | Subject to Turkish law and Turkish courts |
| Public-sector agreement | KVKK Art. 9(4)(a); Reg. Art. 11 | Board permission | Turkish public bodies and public-law professional organisations only |
| Incidental exception | KVKK Art. 9(6)–(7); Reg. Art. 16 | None | Irregular, occasional transfer in a listed situation |
Standard Contractual Clauses: The Operational Reality
For most foreign companies, the standard contract is where compliance succeeds or fails. It covers the data categories, the purposes of the transfer, the recipients, the recipient's technical and administrative measures and additional measures for special category data (Art. 9(4)(c)). The Regulation defines both exporter and recipient by their role as controller or processor, so identify each party's role first.
Use the Clauses Exactly as Published
The standard contract is announced by the Board and its text must be used without any change (Reg. Art. 14(2)–(3)). The parties fill in the information it asks for but cannot rewrite the clauses, and signature must come from the parties or persons authorised to bind them. If a foreign-language version is also signed, the Turkish text prevails — a trap for groups that default to English-only documentation. A modified text, or a missing valid signature, triggers a Board examination under Article 15 of the Law (Reg. Art. 14(7)).
The Five-Business-Day Notification Rule
Signing is not the end of the obligation. The contract must be notified to the Authority within five business days of the signatures being completed, physically, through a registered electronic mail (KEP) address, or by another method the Board specifies (Reg. Art. 14(5)). The parties may agree which of them will notify; if they do not, the exporter must. The filing must include proof of the signatories' authority and a notarised translation of every foreign-language document (Reg. Art. 14(6)). A change of parties or of the details entered in the contract, or its termination, must be notified in the same way (Reg. Art. 14(8)).
Binding Corporate Rules and Written Undertakings
Binding corporate rules need Board approval before any transfer begins; the application includes notarised translations of foreign-language documents, and if the rules also exist in a foreign language the Turkish text governs (Reg. Art. 12). Their minimum content includes a commitment that a controller or processor resident in Türkiye will assume liability for breaches by a group member abroad (Reg. Art. 13(1)(e)). A written undertaking is the bespoke alternative: it must, among other things, restrict onward transfers, let the exporter suspend and terminate, and submit the undertaking to Turkish law and the jurisdiction of the Turkish courts, and data may move only after Board permission (Reg. Art. 15).
Processors, Onward Transfers and Other Duties
The Regulation defines a transfer abroad as sending personal data to a controller or processor abroad or making the data accessible to them in any other way (Reg. Art. 4(1)(e)), so remote access can be a transfer even when no file moves. Article 9 binds controllers and processors alike; a processor must also follow the controller's instructions, and its transfer does not relieve the controller of responsibility (Reg. Arts. 5(1), 7(2)). The same safeguards apply to onward transfers of data already sent abroad (Art. 9(8)), and transfer rules in other laws remain reserved (Art. 9(10)).
The Law's other duties still apply. Privacy notices must say to whom and for what purpose data may be transferred (Art. 10(1)(c)); the VERBIS registration must declare the personal data intended for transfer abroad (Art. 16(3)(d)); and if processed data are obtained by others unlawfully, the controller must notify the data subject and the Board as soon as possible (Art. 12(5)). For the employment side, see our guide on employer obligations for foreign companies in Turkey.
Enforcement: Fines, Suspension and Criminal Exposure
Article 18 sets separate administrative fine bands for breaching the information duty (Art. 10), the data security duties (Art. 12), Board decisions under Article 15, the VERBIS duty (Art. 16) and, since 2024, the standard-contract notification duty (Art. 9(5)); the last band reaches processors as well as controllers (Art. 18(2)). The limits are revalued every calendar year under Misdemeanours Law No. 5326, Art. 17(7), and fines can be challenged before the administrative courts (Art. 18(3)). Where damage that is difficult or impossible to remedy would arise and the breach of law is clear, the Board may order processing, or the transfer of data abroad, to be stopped (Art. 15(7)). On the criminal side, Article 136 of the Turkish Criminal Code punishes anyone who unlawfully gives personal data to another with two to four years' imprisonment.
Common questions about this topic
Does the KVKK apply to a company based outside Turkey?
The Law has no GDPR-style targeting test, but its scope provision (Article 2) is not limited to companies incorporated in Türkiye, and the VERBIS Regulation provides for data controllers not resident in Türkiye, which register through a data controller representative. A Turkish subsidiary is squarely within scope, and an overseas parent that determines the purposes and means of processing may meet the Article 3 definition of a data controller.
Can we still rely on explicit consent for transfers abroad?
Only for incidental transfers. Since 1 September 2024 explicit consent works as an exception under Article 9(6)(a), and the data subject must first be informed of the possible risks. Ongoing flows need an adequacy decision or an appropriate safeguard such as a standard contract.
What happens if we miss the five-business-day SCC notification?
Failing to notify is a separate misdemeanour under Article 18(1)(d), sanctioned by an administrative fine on the controller or processor that should have filed. It has its own band, distinct from the data-security band, and its limits are revalued each year.
Are binding corporate rules worth pursuing for our group?
For multinationals with substantial intra-group data flows, binding corporate rules can provide a group-wide basis that avoids signing a standard contract for each pair of entities. The approval process and the liability commitment required from a Turkey-resident member make them better suited to larger groups with mature governance than to one-off transfers.
Must the standard contract be in Turkish?
The Turkish text is the one that counts. Where the contract is also executed in a foreign language, the Regulation makes the Turkish text prevail, so the Turkish version must be reviewed with the same rigour as the English.
Do we need to register with VERBIS as a foreign-owned company?
Registration is required before processing begins unless the Board has exempted your category under Article 16(2). The notification covers, among other things, the purposes of processing, data categories, recipients, data intended for transfer abroad, security measures and maximum retention periods. Breaching the registration duty falls under the Article 18(1)(ç) fine band.
This guide is general information on Turkish law, not legal advice on your own matter. Rules and practice change; check the position before you act.