International Transfers of Personal Data: Standard Contracts and Practical Requirements

International transfers of personal data constitute an area of legal obligations under the Turkish Personal Data Protection Law No. 6698 (“KVKK”) that must be assessed separately from the conditions for processing personal data. Article 9 of the KVKK, amended in 2024, provides for a tiered system based on adequacy decisions, appropriate safeguards and occasional transfers. Standard contracts and binding corporate rules approved by the Turkish Personal Data Protection Board (“Board”) are among the appropriate safeguards available under this system.

Sharing employee data with foreign group companies, using cloud services located abroad and operating international whistleblowing systems are among the activities covered by these rules. For companies, the main issue is not merely signing a standard contract, but assessing the parties' roles, the conditions for transfers, the notification deadline and the obligation to inform data subjects together. This article examines these obligations through practical examples.

For further information on the general scope of the KVKK and companies' fundamental obligations, please also see our guide on Personal Data Protection Law in Türkiye (KVKK).

Table of contents

• What constitutes an international transfer of personal data, and which activities does it cover?
• What are the requirements for international data transfers under the KVKK?
• Is explicit consent sufficient for transferring personal data abroad?
• How are the roles of data controller and data processor determined?
• Which standard contract should be used for international data transfers?
• How is a standard contract notified, and what is the notification deadline?
• Is compliance with European Union legislation sufficient for transfers to group companies?
• How are onward transfers involving intermediaries and sub-processors assessed?
• How is the obligation to inform data subjects fulfilled in international data transfers?
• What is the difference between masking and anonymisation?
• How can whistleblowing and internal investigation data be transferred abroad?
• How should companies ensure compliance with international data transfer requirements?
• Conclusion

What constitutes an international transfer of personal data, and which activities does it cover?

An international transfer of personal data may occur where a data controller or data processor subject to the KVKK transmits personal data to another data controller or data processor abroad or makes such data accessible to them. A transfer does not necessarily have to involve sending an email or transferring a file.

For example, where a foreign group company accesses the employee records of a company in Türkiye, or a foreign service provider views those records for technical support purposes, the international transfer rules may apply even if no files are downloaded. The storage of personal data in a cloud system operated by a service provider abroad must also be assessed within this framework. Therefore, it is necessary to consider not only the country where the server is located but also the parties that can access the data.

What are the requirements for international data transfers under the KVKK?

The KVKK provides for a tiered system governing international transfers. First, it must be assessed whether the Board has issued an adequacy decision concerning the destination country, a sector within that country or an international organisation. Where no adequacy decision exists, appropriate safeguards such as standard contracts or binding corporate rules approved by the Board may be used. Where these safeguards cannot be provided either, transfers may take place only on an occasional basis and subject to the exceptional conditions specified in the KVKK.

For transfers based on an adequacy decision or appropriate safeguards, one of the conditions for processing personal data under Article 5 or 6 of the KVKK must also be satisfied. Transfers based on appropriate safeguards additionally require that data subjects be able to exercise their rights and access effective legal remedies in the foreign country. Accordingly, the international transfer of data that is lawfully processed in Türkiye must be assessed separately.

Is explicit consent sufficient for transferring personal data abroad?

Where neither an adequacy decision nor appropriate safeguards are available, explicit consent obtained after informing data subjects of the potential risks is an exceptional mechanism that may be used only for occasional transfers. Transfers that are continuous, regular or form part of a company's ordinary business operations cannot be treated as falling within this exception.

For example, the monthly uploading of employee data to a human resources system located abroad cannot be justified under this exception merely by obtaining employees' explicit consent. The decisive factor is not whether each transfer is carried out separately, but whether the transfer process as a whole constitutes a regular and continuous activity.

How are the roles of data controller and data processor determined?

A data controller is the party that determines the purposes for which personal data is processed and the fundamental means of processing. A data processor, by contrast, acts on behalf of and under the instructions of the data controller. In determining the parties' roles, greater weight should be given to the actual decision-making and instruction arrangements governing the specific processing activity than to the designations used in the contract.

For example, a service provider that calculates payroll solely in accordance with the company's instructions does not act in the same capacity as an organisation that uses employee data for separate purposes determined by itself. Similarly, the fact that a foreign company is the group headquarters does not automatically make it a data controller or data processor for every processing activity.

The analysis of roles should therefore be carried out separately for each processing activity, rather than by assigning general labels to organisations. The allocation of responsibilities in contracts must also reflect the actual relationship between the parties.

Which standard contract should be used for international data transfers?

The type of standard contract to be used depends on whether the data exporter and data importer act as data controllers or data processors. The Board has published four different standard contracts:

• Standard contract for transfers from controller to controller: Used where both the data exporter and the data importer act as data controllers.
• Standard contract for transfers from controller to processor: Used where a data exporter acting as a data controller transfers personal data to a data processor located abroad.
• Standard contract for transfers from processor to processor: Used where both the data exporter and the data importer act as data processors.
• Standard contract for transfers from processor to controller: Used where a data exporter acting as a data processor transfers personal data to a data controller located abroad.

Selecting the correct contract requires identifying not only the role of the foreign recipient but also that of the transferring party. Where multiple companies or service providers are involved in the same data flow, each relationship may need to be assessed separately. The starting point for selecting the contract is not the responsibility the parties wish to assume, but the roles they actually perform in the relevant transfer.

Prior authorisation from the Board is not required for transfers based on a standard contract. Nevertheless, the appropriate contract must be validly signed, its annexes completed in accordance with the actual data flow, and the notification obligation fulfilled.

How is a standard contract notified, and what is the notification deadline?

The standard contract must be notified to the Turkish Personal Data Protection Authority (“Authority”) within five business days following completion of all signatures. Notification may be submitted physically, through registered electronic mail (KEP) or via the Authority's Standard Contract Notification Module.

The contract must be signed by the parties to the transfer or by persons duly authorised to represent them and sign on their behalf. Documents evidencing signing authority must also be submitted with the notification. The signing dates of both parties must be clearly indicated, and the party responsible for notification and the preparation of documents should be identified before signing. Where the contract is also executed in a foreign language, the Turkish version must be signed by both parties. Applicable requirements concerning apostilles, legalisation and notarised Turkish translations of foreign official documents must be checked separately.

A standard contract cannot be freely amended in the same manner as an ordinary commercial contract. According to the Authority's explanations, only the necessary selections and adjustments may be made in provisions containing optional or alternative wording. In addition, where all signatures are completed at a later date, a retroactive effective date should not be inserted into the contract.

Is compliance with European Union legislation sufficient for transfers to group companies?

The fact that companies belong to the same international group or that the foreign recipient is subject to the European Union General Data Protection Regulation (“GDPR”) is not, in itself, sufficient for transfers from Türkiye. Contracts and group policies prepared under the GDPR do not automatically replace the transfer mechanisms required under Turkish law.

For intra-group transfers, binding corporate rules may be considered alongside standard contracts. However, there is a distinction between a data protection policy adopted internally by a group and binding corporate rules approved by the Board under the KVKK. Arrangements for transfers involving Türkiye must be addressed separately within the group's global data protection programme.

How are onward transfers involving intermediaries and sub-processors assessed?

The fact that data is initially transferred to a consultant, service provider or group company does not automatically make that party's subsequent disclosure of the data to another recipient lawful. In addition to the initial transfer, any onward disclosures by the foreign recipient must comply with the conditions of the relevant standard contract.

For example, where data transferred from Türkiye to a foreign company is disclosed to another company in the same country, the provisions governing onward transfers may also become applicable. Accordingly, the fact that the data does not cross another national border during the second disclosure is not, by itself, decisive.

However, it cannot be said that a separate standard contract is necessarily required for every onward disclosure. For example, where a sub-processor is engaged under a standard contract for transfers from a controller to a processor, the required authorisation process and a written sub-processing agreement incorporating the safeguards contained in the standard contract are important. The appropriate legal mechanism must be determined according to the role of the subsequent recipient and the provisions of the existing contract.

How is the obligation to inform data subjects fulfilled in international data transfers?

Signing a standard contract does not eliminate the obligation to inform data subjects. Data subjects must be informed of the identity of the data controller, the purposes of processing, the purposes of transfers and the categories of recipients, the method of data collection, the legal basis and their rights. Compliance with the obligation to inform does not depend on a request from the data subject.

A distinction must be made between identifying recipient categories in a general privacy notice and the specific information obligations arising from the selected standard contract. For example, Clause 7.4 of the standard contract for transfers from controller to controller requires data subjects to be informed of the identity and contact details of the foreign data importer, either directly or through the data exporter. Accordingly, referring to a general category of recipients does not mean that all contractual information obligations have been fulfilled.

In addition, under Article 11 of the KVKK, data subjects have the right to learn the identities of third parties to whom their data has been transferred, whether domestically or abroad. Companies should ensure consistency between their general privacy notices, supplementary information provided under contractual obligations and responses to data subject requests.

What is the difference between masking and anonymisation?

Removing a person's name from a record does not always amount to anonymisation. If the individual can still be identified through their job title, department, the date of an incident or by matching the information with other records, the information remains personal data.

For example, referring to the sole manager of a particular department in a report from which the name has been removed may not prevent the person's identity from being determined. Similarly, using a code instead of a name where the code can be decoded through a matching table differs from genuine anonymisation. Masking may be a measure that reduces risk, but it does not, by itself, eliminate the obligations governing international data transfers. When assessing anonymisation, the data must remain incapable of being linked to an individual even when combined with other information.

How can whistleblowing and internal investigation data be transferred abroad?

When assessing whistleblowing and internal investigation processes, account must be taken not only of the personal data of the reporting person but also of the data of persons who are the subject of reports, witnesses and other individuals named in the documents. The fact that a report has been submitted anonymously does not mean that all information contained in it is anonymous.

These processes may also involve special categories of personal data, such as health information or trade union membership. In such cases, the appropriate processing condition under Article 6 of the KVKK and the adequate safeguards specified by the Board must be assessed separately. The fact that a file relates to an investigation does not justify unlimited processing of all data contained in it.

Where data is not obtained directly from the data subject, the timing of the privacy notice is also important. Subject to applicable statutory exceptions, if the data is to be transferred, the obligation to inform must be fulfilled no later than the time of the first transfer. The need to preserve the confidentiality of an investigation should not, in itself, be treated as a general exemption from the obligation to inform.

How should companies ensure compliance with international data transfer requirements?

The starting point for compliance work should be the actual data flow, rather than a list of contracts in use. It is useful to prepare an assessment matrix for each process showing the categories of personal data, purposes, recipients, the parties' roles and the transfer mechanism together.

The annexes to the contract should also be completed on the basis of this assessment. Rather than describing the scope of the transfer in broad terms, the data to be transferred, the purposes for which it will be transferred and the applicable safeguards should be specified. The Board's standard contract system likewise requires the details of the transfer and the technical and administrative measures to be identified.

The implementation of contracts should be supported by access permissions, secure communication methods, clearly defined employee responsibilities and audit processes. Outsourcing a data processing activity does not relieve the data controller of its responsibility for data security. Where personal data is processed by another person on behalf of the data controller, the data controller and data processor are jointly responsible for ensuring that the necessary security measures are taken.

Finally, documents should be reviewed again where recipients or sub-processors change, a new system is introduced or the scope of the transfer expands. The obligations to update annexes and provide notifications under the standard contracts should also form part of change management.

Conclusion

International transfers of personal data are not transactions completed merely by signing a contract; they constitute an area of compliance requiring legal assessment, the provision of information, data security and ongoing monitoring. For companies, the principal objective is to ensure consistency between the obligations undertaken in the standard contract and day-to-day operations.

GEMS Schindhelm Istanbul advises clients on assessing international personal data transfer processes, determining the roles of data controllers and data processors, selecting appropriate transfer mechanisms, preparing standard contracts and supplementary documents, organising privacy notice procedures and managing notifications to the Authority. Please contact our team with any questions regarding this subject.