Page 1

PERSONAL DATA
ABROAD
TRANSFERRING

Page 2

I. DATA ABROAD
TRANSFER
According to Article 9 of the Law, data transfer abroad;
• Having the explicit consent of the person concerned,
• Countries with adequate protection (by the Board)
safe countries) in the transfer of personal data,
The existence of the situations specified in the Law (Article 5 of the Law).
2nd paragraph of Article 6 and 3rd paragraph of Article 6
specified conditions)
• Personal data to countries where adequate protection is not available
transfer, in case of existence of the situations specified in the Law
(Paragraph 2 of Article 5 and 3 of Article 6 of the Law).
conditions specified in the paragraph) of adequate protection in writing.
commitment and obtaining the permission of the Board,

cases can be performed.

one

Page 3

The law, with the processing of personal data,
seeks the same conditions in terms of transfer. Also personal
Taking additional measures in transferring data abroad
envisaged.

In case of explicit consent of the person concerned, personal data
It is possible to transfer abroad. In cases other than express consent,
In the transfer of personal data abroad, the law
whether there is adequate protection in the country in which
brought different provisions.
According to this;

2nd

Page 4

A) Finding Adequate Protection
Transfer of personal data;
• It is clearly stipulated in the laws,
• Will not be able to express consent due to actual impossibility
legal validity of the situation or consent
the life of the unrecognized person or of another person
or it is necessary for the protection of bodily integrity,
• Directly with the conclusion or performance of a contract
personal property of the parties to the contract, provided that
it is necessary to process the data,
• Fulfilling the legal obligation of the data controller
mandatory to bring
• The person concerned has been made public by himself,
• Data for establishment, exercise or protection of a right
processing is mandatory
• Not to harm the fundamental rights and freedoms of the person concerned.
for the legitimate interests of the data controller, provided that
mandatory to process
can be transferred abroad.

3

Page 5

Transfer of special categories of personal data;
Special categories of personal data other than health and sexual life
(person's race, ethnic origin, political opinion, philosophical belief, religion,
sect or other beliefs, disguise, association, foundation or
union membership, criminal convictions and security measures.
related data and biometric and genetic data) are clearly stated in the law.
It can be transferred abroad if foreseen.
Health and sexual life of persons in countries with adequate protection
personal data related to the protection of public health,
preventive medicine, medical diagnosis, treatment and care services
management, planning and financing of health services and

4

Page 6

under the obligation of keeping secrets, for the purpose of managing
by persons or authorized institutions and organizations
It can be transferred abroad without seeking its consent.

Countries with adequate protection declared by the Board
will be.

5

Page 7

B) Adequate Protection
Absence
• Paragraph 2 of Article 5 and 3 of Article 6 of the Law.
fulfillment of one of the conditions specified in paragraph
• Data controllers in Turkey and the relevant foreign country
undertake in writing to an adequate protection,
• Having the permission of the board

can be transferred abroad.

6

Page 8

II. ADEQUATE PROTECTION
COUNTRIES FOUND
DETERMINING AND
FOUNDATION ABROAD
TO DATA TRANSFER
PERMISSIONS TO BE GRANTED
TO BE CONSIDERED
MATTERS
In the relevant country in the transfer of personal data abroad
whether adequate protection is available
in case of absence, in Turkey and the relevant foreign
data controllers in the country have written an adequate protection
personal data, provided that they undertake to
Board to be transferred out;

7

Page 9

• International conventions to which Turkey is a party,
• Data between the country requesting personal data and Turkey
the reciprocity of the transfer,
• Regarding each concrete personal data transfer, personal data
the nature of the data and the purpose and duration of its processing,
• The country to which the personal data will be transferred is relevant to the subject.
legislation and its implementation,
• Data in the country to which personal data will be transferred
measures committed by the responsible
to evaluate and, if needed, the relevant institution
and taking the opinions of the organizations.
In addition, the provisions of international conventions are reserved.
provided that the interests of Turkey or the person concerned are seriously
In cases where personal data will be damaged in such a way, only
taking the opinion of the relevant public institution or organization
It is foreseen to be transferred abroad with the permission of the Board.
Other related to the transfer of personal data abroad
the provisions of the laws are reserved.

8

Page 10

PERSONAL DATA ABROAD A

If there is express consent

Data can be transferred abroad.

* Personal data, international contract provisions are reserved
provided that the interests of Turkey or the person concerned are seriously
in any way damaged, only if the relevant public
institution or institution, with the permission of the Board.
can be exported.

9

Page 11

OF INTERNATIONAL

Articles 5/2 and 6/3 of the Law
if conditions are met

Finding Adequate Protection

Lack of Sufficient Protection

Data can be transferred abroad.

data in Turkey
data in the country to be transferred
enough of those responsible
protection in writing.
commitment and Board permission
receiving

Data can be transferred abroad.

10

Page 12

Nasuh Akar Mah. 1407. Street No:4 06520
Balgat-Çankaya/Ankara // www.kvkk.gov.tr
Tel: 0 (312) 216 50 50 // Fax: 0(312) 216 50 52

