KVKK Cross-Border Data Transfer: 2026 Guide to Standard Contracts

KVKK cross-border data transfer rules are among the first compliance questions any international company faces once it starts processing personal data in Turkey. Sending employee records to a group HR system, hosting customer data with a global cloud provider or sharing CRM data with a foreign parent company all count as transfers abroad under Turkey’s Personal Data Protection Law No. 6698, known as KVKK. Since 2024, the rules governing these transfers have been rebuilt along lines that will look familiar to anyone who knows the GDPR, but with important local differences.

This guide explains the current KVKK cross-border data transfer framework, how standard contracts work in practice, the notification obligation that many foreign companies overlook, and the sanctions for getting it wrong. It updates and expands our earlier Turkish-language note, Kişisel Verilerin Yurtdışına Aktarılmasında Yeni Dönem.

How the KVKK Cross-Border Data Transfer Regime Changed

Before 2024, Article 9 KVKK allowed transfers abroad on two bases: the data subject’s explicit consent, or, without consent, transfers to countries with adequate protection or with written undertakings approved by the Personal Data Protection Board. Since the Board never published a list of safe countries and approved very few undertakings, explicit consent became the default tool in practice, even though it was ill-suited to large-scale transfers such as employee data.

Law No. 7499, published in the Official Gazette No. 32487 of 12 March 2024, rewrote Article 9 with effect from 1 June 2024. The detailed procedures followed in the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, published in the Official Gazette No. 32598 of 10 July 2024. Transfers based on explicit consent under the old Article 9 were allowed to continue only until 1 September 2024. Any company still relying on consent collected under the old regime should therefore treat its transfers as non-compliant.

Three Routes for Transfers Abroad

The amended Article 9 turns KVKK cross-border data transfer into a layered system. A company must first look for an adequacy decision, then for an appropriate safeguard, and only as a last resort rely on an incidental transfer exception. In every case, one of the general processing conditions in Articles 5 or 6 KVKK must also be met.

Adequacy Decisions

Personal data may be transferred abroad where the Board has issued an adequacy decision for the destination country, for specific sectors within that country, or for an international organisation. Companies should check the Board’s current decisions before relying on this route, since in practice most transfers continue to rely on safeguards.

Appropriate Safeguards

Where there is no adequacy decision, data may be transferred if one of the appropriate safeguards listed in the law is in place and the data subject can exercise their rights and access effective remedies in the destination country. The available safeguards are an agreement between public authorities or international organisations, approved by the Board; binding corporate rules approved by the Board for transfers within a multinational group; standard contracts announced by the Board; and a written undertaking providing adequate protection, again with Board approval.

For most private companies, standard contracts are the practical choice for KVKK cross-border data transfer. Binding corporate rules are an option for large groups, but the approval process is detailed and slow.

Incidental Transfers

If neither an adequacy decision nor a safeguard is available, data may be transferred only on an incidental basis, meaning transfers that are irregular, occur once or a few times and fall outside the normal course of business. The exceptions include explicit consent given after the data subject has been informed of the possible risks, performance of a contract with the data subject, the establishment or defence of legal claims, and the protection of vital interests. Regular, systematic transfers such as hosting customer data abroad cannot be justified on this basis.

Standard Contracts Under KVKK

The Board has published four standard contract modules that mirror the structure of the EU standard contractual clauses: controller to controller, controller to processor, processor to processor and processor to controller. The parties must choose the module that matches their roles and use the text without amending its substance. The contract must be signed by the parties or their authorised representatives.

Companies used to the GDPR should not assume that EU clauses can be used for a KVKK cross-border data transfer. A transfer of personal data from Turkey requires the KVKK standard contract, even if the same parties have already signed EU clauses for their European data flows.

The Five-Business-Day Notification

The most frequently missed KVKK cross-border data transfer requirement is notification. A signed standard contract must be notified to the Personal Data Protection Authority within five business days of signature. The parties must also notify the Authority if the parties or the content of the contract change, or if the contract terminates, and they must submit documents evidencing the signatories’ authority. Since October 2024, notifications can be submitted online through the Authority’s Standard Contract Notification Module.

Failure to notify is a separate administrative offence under Article 18 KVKK. The fine range is revalued every year, and for 2026 it is between TRY 90,308 and TRY 1,806,377. Since every unnotified contract can be assessed separately, the exposure for a group with many intra-group and vendor transfers can add up quickly.

Onward Transfers and Cloud Services

The Regulation also covers onward transfers. Where the recipient abroad transfers the data to a third country or an international organisation, the onward transfer must itself meet the requirements of Article 9 and be reflected in the arrangements between the parties. Cloud hosting, remote IT support and the use of software tools that store data on servers abroad all count as a KVKK cross-border data transfer, so service agreements with these providers need the relevant standard contract module alongside a data processing agreement.

A Practical KVKK Cross-Border Data Transfer Checklist

International companies operating in Turkey should begin by mapping their data flows: what personal data leaves Turkey, to which country and which recipient, and for what purpose. Each flow then needs a legal basis under Article 5 or 6 and a transfer mechanism under Article 9. For flows relying on standard contracts, the correct module should be signed by authorised signatories and notified within five business days, with the notification record kept on file. Privacy notices should be updated to inform data subjects of transfers abroad, and the company’s registration in VERBIS, the data controllers’ registry, should be reviewed where registration is required.

Companies that have not reviewed their KVKK cross-border data transfer arrangements since the 2024 reform should prioritise employee data, customer data hosted abroad and intra-group reporting, which are the flows most often still based on outdated consent forms.

Frequently Asked Questions

Can we still rely on explicit consent for transfers abroad?

Only for incidental transfers, and only where the data subject has been informed of the possible risks. Regular transfers must rely on an adequacy decision or an appropriate safeguard such as a standard contract.

Are EU standard contractual clauses valid for transfers from Turkey?

No. Transfers from Turkey require the standard contract modules published by the Turkish Personal Data Protection Board, notified to the Authority within five business days.

Does storing data with a foreign cloud provider count as a transfer?

Yes. Where personal data is stored or accessed on servers abroad, the KVKK cross-border data transfer rules apply and a suitable mechanism is required.

How KYO Legal Can Help

KYO Legal advises international companies on KVKK compliance, including data mapping, standard contract selection and notification, intra-group data flows and VERBIS registration. Learn more about our data protection law practice or contact us. If you are setting up operations in the country, our guide to entering the Turkish market may also help. The standard contract texts are published on the Personal Data Protection Authority’s website.

This article is for general information only and does not constitute legal advice. Please seek specific advice for your situation.