Transferring Personal Data Abroad: Current Legal Framework In Turkey

Published in the Official Gazette No. 32487 dated 12.03.2024, Law No. 7499 introduced changes to the Personal Data Protection Law No. 6698 (the "Law"). Subsequently, the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad ("Regulation") was published and came into effect in the Official Gazette No. 32598 dated 10.07.2024. In January 2025, the Guide on Transferring Personal Data Abroad ("Guide") was published on the website of the Personal Data Protection Authority ("Authority").

1. Introduction

Previously, transferring personal data abroad without obtaining the explicit consent of the data subject, required the existence of one of the conditions foreseen by the Law, and the Personal Data Protection Board ("Board") deciding that the country to which the data would be transferred had adequate protection (being listed on the safe countries list). If a country was not deemed to have adequate protection, personal data could still be