Article 9 - Transfer of personal data abroad

(1) Personal data cannot be transferred abroad without explicit consent of the data subject.

(2) Personal data may be transferred abroad without explicit consent of the data subject provided that one of the conditions set forth in the second paragraph of Article 5 and the third paragraph of Article 6 exist and that;

  • (a) sufficient protection is provided in the foreign country where the data is to be transferred,
  • (b) the controllers in Türkiye and in the related foreign country guarantee a sufficient protection in writing and the Board has authorized such transfer, where sufficient protection is not provided.

(3) The Board determines and announces the countries where sufficient level of protection is provided.

(4) The Board shall decide whether there is sufficient protection in the foreign country concerned and whether such transfer will be authorised under the sub-paragraph (b) of second paragraph, by evaluating the followings and by receiving the opinions of related public institutions and organizations, where necessary:

  • a) the international conventions to which Türkiye is a party,
  • b) the state of reciprocity concerning data transfer between the requesting country and Türkiye,
  • c) the nature of the data, the purpose and duration of processing regarding each concrete, individual case of data transfer,
  • ç) the relevant legislation and its implementation in the country to which the personal data is to be transferred,
  • d) the measures guaranteed by the controller in the country to which the personal data is to be transferred,

(5) In cases where interest of Türkiye or the data subject will seriously be harmed, personal data, without prejudice to the provisions of international agreements, may only be transferred abroad upon the permission to be given by the Board after receiving the opinions of related public institutions and organizations.

(6) Provisions of other laws concerning the transfer of personal data abroad are reserved.