Important Development Regarding the Transfer of Personal Data Abroad
The Personal Data Protection Board (“Board”) has authorised the transfer of personal data through an agreement that does not constitute an international treaty, pursuant to Article 9/4-a of the Personal Data Protection Law No. 6698 (“KVKK”).
Article 9/4-a of the KVKK stipulates that personal data may be transferred abroad if there is an agreement that does not constitute an international treaty between public institutions and organisations abroad or international organisations and public institutions and organisations in Turkey or professional organisations with the status of public institutions, and if the Board permits the transfer.
With the Board’s decision dated 21 October 2025; The agreement signed between the Ministry of Interior, Directorate General of Migration Management and the United Nations High Commissioner for Refugees (UNHCR), which forms the basis for the transfer of personal data abroad, has been evaluated under Article 11 of the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad, and permission for the transfer has been granted.
This decision is noteworthy as it marks the first time that the issue of ‘ensuring adequate safeguards through agreements that do not constitute international treaties’ has been raised in the KVKK and the relevant Regulation, following the update made in 2024. This development signals that the different paragraphs of Article 9 will gradually be applied in practice with regard to the transfer of personal data abroad.