KVKK article 9: Since Türkiye does not have a list of countries that provide "adequate protection", explicit consent is required for international transfers.
Transfer Abroad
- Explicit consent
- Commitment signed + Board permission
- Binding company rules (BCR)
Typical Transfers
- AWS, Azure, GCP cloud
- Marketing automation (HubSpot, Salesforce)
- Call center off-shore
- Backup servers
- Software/SaaS services
Explicit Consent Issues
- Customer may not want to give separate consent for each transfer
- Providing service Making conditions invalid
- Custody for child data
Practical Solutions
- Domestic alternative (domestic cloud: TURKCELL, Türk Telekom)
- Letter of Commitment + Board permission
- Anonymized data transfer
- Explicit consent comprehensive design
KVKK Board Approach
KVKK The Board has imposed serious administrative fines on companies that transfer data abroad, and conducts strict inspections, especially for "transfers hidden within the service contract".
KVKK expert lawyer is recommended.