Cross-Border Personal Data Transfers and GDPR Compliance: Legal Obligations for Businesses

1. Introduction: The Importance of Cross-Border Data Transfers in the Digital Economy

With the rapid development of digitalisation, business activities have increasingly acquired an international dimension. Multinational companies, cloud computing services, international payment systems, and digital platforms regularly transfer personal data to servers, business partners, and service providers located in different countries.

For example, a company operating in Türkiye may store its customers’ personal information using a cloud service provider located abroad or transfer employee data to its headquarters in another country. Such activities may trigger legal obligations concerning the international transfer of personal data.

Although these transfers provide businesses with operational flexibility and commercial advantages, they may also create significant risks in terms of personal data protection. The level of legal protection in the destination country, the ability of data subjects to exercise their rights, and the security obligations of businesses are among the principal issues that must be considered.

This raises an important question: What legal requirements must businesses comply with when transferring personal data internationally, and what obligations arise under the GDPR?

In Türkiye, the Law on the Protection of Personal Data No. 6698 (the Turkish DP Law or KVKK) and, within the European Union, the General Data Protection Regulation (GDPR) establish the principal legal frameworks governing cross-border personal data transfers.

2. What Are Cross-Border Personal Data Transfers?

Cross-border personal data transfers refer to the transmission of personal data relating to an identified or identifiable individual from one country to another, or the provision of access to such data to recipients located in another country.

These transfers are not limited to situations in which companies directly send data abroad. Data sharing between multinational companies within the same corporate group, processing activities carried out by foreign service providers, and the use of international cloud systems may also require an assessment under the applicable data protection legislation.

Examples include:

• A company operating in Türkiye transferring customer information to its parent company in Europe.
• A business storing employee information in a human resources software system hosted abroad.
• Personal data belonging to users in Türkiye being processed on servers located in another country.
• Customer information being shared with an international payment service provider.

These examples demonstrate that cross-border data transfers may arise in connection with various commercial activities.

However, not every international data-sharing activity is subject to the same legal assessment. The destination country, the legal status of the parties, the purpose of processing, and the applicability of the relevant legislation must all be considered.

3. Transfers of Personal Data Abroad Under Turkish Law: Article 9 of the Turkish DP Law

The transfer of personal data abroad in Türkiye is regulated under Article 9 of the Law on the Protection of Personal Data No. 6698.

Following amendments introduced by Law No. 7499 in 2024, the legal framework governing international data transfers was significantly revised. These amendments entered into force on 1 June 2024.

The revised framework introduced a tiered system based on adequacy decisions, appropriate safeguards, and specific derogations for exceptional transfer circumstances.

Under this system, the transfer of personal data abroad requires both a lawful basis for processing under Articles 5 or 6 of the Turkish DP Law and compliance with the relevant transfer conditions set out in Article 9.

Accordingly, obtaining the data subject’s explicit consent or entering into a data-sharing agreement between companies is not necessarily sufficient in every situation. The legal basis for processing and the safeguards applicable to the transfer must also be assessed.

3.1. Adequacy Decisions

One of the principal legal mechanisms for transferring personal data abroad under the Turkish DP Law is an adequacy decision.

The Personal Data Protection Board may determine that an adequate level of protection exists in relation to a particular country, sectors within that country, or an international organisation.

When assessing whether an adequate level of protection exists, the Board may consider factors such as the destination country’s data protection legislation, the independence of its supervisory authorities, the legal remedies available to data subjects, and its international obligations.

Where an adequacy decision has been issued, personal data may be transferred without the need for an additional appropriate safeguard mechanism, provided that a lawful processing condition under Articles 5 or 6 is also satisfied.

3.2. Appropriate Safeguards

Where no adequacy decision exists in relation to the destination country, one of the appropriate safeguards specified in Article 9 of the Turkish DP Law must generally be implemented.

The principal safeguard mechanisms recognised under the Law include:

• Agreements between public institutions and organisations that do not constitute international treaties.
• Binding corporate rules.
• Standard contractual clauses announced by the Personal Data Protection Authority.
• Written undertakings containing provisions that ensure adequate protection, subject to the Board’s authorisation.

Standard contractual clauses are particularly important because they provide businesses with a structured legal mechanism for international data transfers.

4. Standard Contractual Clauses and Legal Safeguards for International Data Transfers

Standard contractual clauses are contractual templates published by the Personal Data Protection Authority to establish safeguards for the transfer of personal data abroad.

These clauses create specific data protection obligations between the transferring party and the recipient located in another country.

Their primary purpose is to ensure that personal data remains subject to appropriate protection after being transferred to a foreign jurisdiction.

The Turkish Personal Data Protection Authority has published different standard contractual clause templates for various transfer relationships, including:

• Controller-to-controller transfers.
• Controller-to-processor transfers.
• Processor-to-controller transfers.
• Processor-to-processor transfers.

Where standard contractual clauses are used, obtaining a separate transfer authorisation from the Board is not required. However, the parties must notify the Personal Data Protection Authority within five business days following the execution of the agreement.

For the clauses to be valid, it is important to correctly identify the parties, ensure that the agreements are signed by authorised representatives, and avoid making unauthorised amendments to the official contractual templates.

Therefore, businesses involved in international data transfers should not consider signing the agreement as the only compliance requirement. They must also fulfil the notification obligation and ensure that the contractual safeguards are properly implemented.

5. International Data Transfers Under the GDPR

The General Data Protection Regulation (GDPR) establishes a comprehensive legal framework governing the processing and protection of personal data within the European Union.

Articles 44 to 50 of the GDPR regulate the transfer of personal data to countries outside the European Economic Area (EEA).

These provisions aim to ensure that the level of protection guaranteed by the GDPR is maintained when personal data is transferred to third countries.

The GDPR provides three principal mechanisms for international data transfers.

5.1. Adequacy Decisions

Under Article 45 of the GDPR, the European Commission may determine that a country outside the European Union ensures an adequate level of protection for personal data.

Where an adequacy decision exists, personal data may be transferred to that country without requiring an additional transfer mechanism. However, the other applicable obligations under the GDPR continue to apply.

In making an adequacy decision, the European Commission considers factors such as the country’s legal framework, the independence of its data protection supervisory authority, the rights available to data subjects, and the existence of effective legal remedies.

5.2. Standard Contractual Clauses (SCCs)

Standard Contractual Clauses are among the principal mechanisms available for transferring personal data to countries that have not received an adequacy decision.

Regulated under Article 46 of the GDPR, SCCs are based on contractual provisions adopted by the European Commission.

These clauses establish the obligations of the data exporter and the data importer concerning the protection of personal data.

However, signing SCCs may not always be sufficient on its own. Businesses must also assess whether the contractual safeguards can be effectively implemented in light of the laws and practices of the destination country.

Where necessary, additional technical and organisational measures may be required. This assessment has become particularly important following the Court of Justice of the European Union’s Schrems II judgment, which significantly influenced the interpretation of international data transfer requirements.

5.3. Binding Corporate Rules (BCRs)

Binding Corporate Rules constitute another legal mechanism that may be used for international personal data transfers within the same corporate group.

This mechanism is particularly relevant for multinational companies operating in several countries, as it aims to establish common data protection standards among group entities.

To be valid, Binding Corporate Rules must satisfy the requirements set out in Article 47 of the GDPR and receive approval from the competent data protection supervisory authority.

Their implementation helps multinational corporate groups establish a consistent legal framework for personal data transfers between their entities in different jurisdictions.

6. Key Differences Between the Turkish DP Law and the GDPR

Although the Turkish DP Law and the GDPR pursue similar objectives in protecting personal data, they contain certain differences in their international transfer mechanisms and implementation requirements.

An important point to emphasise is that the Turkish DP Law and the GDPR are not interchangeable.

A company’s compliance with the Turkish DP Law does not automatically mean that it has fulfilled its obligations under the GDPR where that Regulation is applicable.

For example, a company established in Türkiye may fall within the territorial scope of the GDPR if it offers goods or services to individuals in the European Union or monitors their behaviour. In such circumstances, the company’s obligations under both the Turkish DP Law and the GDPR must be assessed separately.

7. Legal and Technical Obligations Businesses Should Consider

Businesses carrying out cross-border data transfers should not treat legal compliance as a process limited to preparing and signing transfer agreements.

From the beginning of the transfer process, companies should identify the purposes for which personal data is processed, the parties with whom it is shared, and the security measures applied.

In particular, businesses should consider the following requirements:

• Maintaining a data inventory: Companies should identify which categories of personal data are transferred, to which countries, for what purposes, and to which recipients.
• Identifying the legal basis for the transfer: The applicable transfer mechanism under the Turkish DP Law and the GDPR should be clearly established.
• Preparing appropriate agreements: Relationships between data controllers and data processors should be regulated through appropriate data processing and transfer provisions.
• Implementing technical and organisational measures: Security measures such as encryption, access controls, authorisation procedures, and security audits should be implemented.
• Protecting data subjects’ rights: Individuals must be able to exercise their statutory rights, including rights of access, rectification, erasure, and other applicable rights.
• Assessing sub-processors and service providers: The possibility of further transfers to third-party service providers or other countries should be examined.

For businesses using cloud computing services, it is particularly important to assess where the data is stored and the legal status of the relevant service providers.

Furthermore, data protection obligations do not end once the transfer has taken place. Businesses must conduct regular compliance reviews and keep their data protection policies up to date.

8. Legal Consequences of Unlawful Transfers of Personal Data

Transferring personal data abroad without satisfying the required legal conditions may result in administrative and legal consequences for businesses.

In Türkiye, violations involving the processing or transfer of personal data may lead to administrative fines under Article 18 of the Turkish DP Law. Furthermore, where individuals suffer damage, civil liability and compensation claims may arise depending on the circumstances of the case.

Under the GDPR, violations of international data transfer provisions may also result in administrative fines pursuant to Article 83.

Under Article 83 of the GDPR, certain infringements, including violations of international data transfer requirements, may result in administrative fines of up to EUR 20 million or 4% of the undertaking’s total worldwide annual turnover for the preceding financial year, whichever is higher. The applicable sanction is determined by considering the nature of the infringement and the other criteria specified in the Regulation.

For this reason, businesses conducting international data transfers should establish their compliance procedures in advance to minimise potential regulatory sanctions and reputational damage.

9. Conclusion: The Importance of Legal Compliance in International Data Transfers

As the digital economy continues to expand, the transfer of personal data between different countries has become a regular part of international commercial activities. Nevertheless, cross-border data transfers require businesses to carefully assess not only their technical infrastructure but also their legal obligations.

The amendments introduced to Article 9 of the Turkish DP Law in 2024 established a revised framework based on adequacy decisions and appropriate safeguards for international data transfers. Within the European Union, Articles 44 to 50 of the GDPR provide the principal legal framework governing such transfers.

Compliance with both the Turkish DP Law and the GDPR is particularly important for multinational companies, businesses working with international service providers, and digital platforms.

Ultimately, legal compliance in cross-border personal data transfers involves more than merely meeting formal regulatory requirements. Businesses must ensure data security, protect the rights of data subjects, and conduct international transfers through appropriate legal safeguards.

Adopting this approach helps reduce legal risks while maintaining trust in international commercial relationships.