KVKK article 9 stipulates "adequate protection" in international data transfer. Türkiye's "qualified country" list is still very limited; For most cloud providers, Standard Contract (TR-SCC) or explicit consent is the only option.
KVKK article 9 — international transfer rule
- Explicit consent of the data owner, or
- Country that provides adequate protection (declares KVKK), or
- If the country is not sufficient: Written undertaking between the data controller + recipient + KVKK permission.
Adequate country list (up to 2025)
KVKK has not yet published the official list. Practically, a separate letter of undertaking + KVKK permission is required for each transfer.
Common scenarios
- AWS, Azure, GCP: Data in US/EU data centers — overseas.
- Salesforce, HubSpot: US-based SaaS — overseas.
- Google Workspace, M365: Data is global — abroad.
- Stripe, PayPal: Payment processor — foreign + additional financial regulation.
3 solutions
Frequently asked questions
There is AWS Türkiye region; Is this enough?
The Istanbul AWS region provides local data storage; but backup can go to Frankfurt or Dublin. "Data Residency" must be clearly defined in the contract + technical configuration.
It is very difficult to obtain consent from individual customers; alternative?
Standard Contract + KVKK permission. EU SCC sample text Turkish translation + Board application with local improvements. KVKK permission comes within 4-6 months.
We use Google Analytics; problem?
In Europe, some DPAs issued warnings about GA4 (post Schrems II). For Türkiye: anonymous usage mode + IP anonymization + Standard Agreement recommended. Alternative: Plausible, Matomo (on own server).
Is Schrems II implemented in Türkiye?
Not directly; But KVKK takes it as an example. The CLOUD Act and FISA 702 risks in transfer to the USA were reflected in the Board's decisions. Additional security (encryption at rest, key management in Türkiye) is recommended.
If violated, to which authority?
If the Turkish data owner is affected, KVKK; If an EU data subject is affected, the relevant EU DPA. Most violations require parallel notification; Both institutions operate independently.
Relevant legislation
- KVKK no. 6698 article 12 — Data security obligation; notice of violation (art.12/5).
- KVKK no. 6698 article 14 — Right to compensation.
- KVKK no. 6698 article 18 — Administrative fine (up to 5 million TL).
- GDPR Art. 33-34 — 72-hour infringement notification on EU cross-border transfer.
- TCK art.135-136 — Unlawful recording/dissemination of personal data.