European groups with manufacturing subsidiaries in Turkey commonly run them on the same systems as their other European plants. Where, for example, a subsidiary operating a plant in Manisa keeps its personnel records on the group’s HR platform hosted in Frankfurt, personal data leaves Turkey every time a record is created or updated. A second flow begins when a group helpdesk in Pune provides technical support through remote access to the subsidiary’s computers. Both data transfers are governed by Article 9 of the KVKK, Turkey’s Personal Data Protection Law No. 6698. The subsidiary will often have acceded, some years earlier, to the group’s data transfer agreement based on the European Commission’s standard contractual clauses, and the matter will have been treated as closed. Under Turkish law as it stands in November 2026, neither transfer rests on a valid mechanism.

The European clauses were written for personal data leaving the European Economic Area, and they continue to govern data flowing from the group into Turkey. Data leaving Turkey is subject to Article 9 of the KVKK, which was rewritten in 2024 and now comes with its own standard contracts and its own filing duty. The Personal Data Protection Board (the Board) has not published an adequacy decision for any country. A transfer to a group company in Germany therefore needs the same appropriate safeguard as a transfer to one in India. For groups that have invested in Turkey through a local subsidiary, the Turkish side of the transfer documentation therefore has to be built separately.

The 2024 Reform of KVKK Data Transfers

Until 2024 most Turkish subsidiaries moved data abroad on the strength of employee and customer consent forms, because the alternative, an undertaking approved by the Board, could take a very long time to obtain. Law No. 7499 of 2 March 2024 replaced Article 9 of the KVKK with a tiered structure for data transfers, which entered into force on 1 June 2024. Provisional Article 3 of the KVKK kept the old consent rule running alongside the new text until 1 September 2024, and that window closed more than two years ago.

Where the destination has no adequacy decision, Article 9(4) still requires one of the processing conditions in Articles 5 and 6. The data subject must also be able to exercise their rights and seek effective remedies in the destination country, and the parties must put in place one of the appropriate safeguards listed in the provision. For a private group those safeguards are, in practice, standard contracts announced by the Board or binding corporate rules approved by it. The remaining options concern public bodies or depend on a separate permission from the Board.

The procedure is set out in the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, published in Official Gazette No. 32598 of 10 July 2024, and the Board adopted the four standard contract texts by its decision No. 2024/959 of 4 June 2024. Consent survives only as one of the incidental exceptions in Article 9(6), and only after the data subject has been informed of the possible risks.

Remote Access and Group Platforms as KVKK Data Transfers

The Personal Data Protection Authority (the Authority) published its Guide on the Transfer of Personal Data Abroad on 2 January 2025, and its approach to remote access is wider than many group IT departments expect. Access from a third country to a system in Turkey counts among the data transfers governed by the KVKK even where the data is only displayed on a screen for support or administration. The Guide describes the acts that make data accessible in this sense, among them creating an account, granting access to an existing account, approving a remote access request and sending the password to a file. The helpdesk in Pune is therefore making transfers every working day, whether or not a single record is downloaded.

The Guide also uses an example that most foreign groups will recognise. A Turkish subsidiary sends employee data to its parent’s central HR database abroad, the parent acts as processor, and the Guide treats the flow as a transfer requiring a mechanism under Article 9. A group CRM instance and a global payroll provider fall into the same category. Where the parent’s platform is itself hosted by a cloud provider in a further country, that onward leg is caught too. Article 9(8) requires the safeguards of the KVKK to follow the data into any onward transfer.

Why the Group Agreement Does Not Cover Turkey

The standard contracts for KVKK data transfers come in four types, covering transfers from controller to controller, controller to processor, processor to processor and processor to controller. Article 14 of the Regulation requires them to be used without amendment and provides that, where a contract is also concluded in a foreign language, the Turkish text prevails. The Authority has published English translations of the four texts for convenience, but they carry no independent weight. In its announcement of 5 February 2025 the Authority added that the parties may change only the clauses offered as optional or alternative. A group agreement drafted on the European model with a Turkish annex attached is a different document and cannot meet that test.

Two features of the Turkish texts matter particularly within a group. The controller to controller and controller to processor contracts are governed by Turkish law and refer disputes to the Turkish courts. Data subjects may enforce most of their clauses as third party beneficiaries, which is how the texts give substance to the condition on enforceable rights and remedies in Article 9(4). It also means that a parent company in Germany or the United States signs a contract under which a Turkish employee may bring a claim against it before a Turkish court.

The texts contain no docking clause either. Each contract names one exporter and one importer, and nothing in the wording allows another group company to accede later. The Authority has not said in terms whether several importers may sign a single standard contract. In our view they may not, given the bilateral structure of the texts and the prohibition on amendments. A Turkish subsidiary sending data to its parent and to a shared service centre therefore needs two separate contracts, each notified on its own.

Signatures, Authority Documents and the Five Day Clock

Both parties must sign the Turkish text, or the Turkish column of a bilingual version, and both signature dates must appear on the contract so that compliance with the deadline can be checked. The signatories’ authority has to be evidenced. For the foreign party this normally means a commercial register extract or a board resolution carrying an apostille, with a notarised Turkish translation of every document in a foreign language. The contract may not state an effective date earlier than the date on which the signatures were completed. Article 9(5) then requires notification to the Authority within five business days of signature, through a registered electronic mail (KEP) address or the notification module opened on 25 October 2024, and paper filing remains available. Where the contract does not allocate the filing duty, it falls on the exporter.

The order of these steps matters more than any one of them. The clock starts with the last signature, and an apostilled extract with a certified translation, obtained from a register abroad, rarely arrives within five business days. A group that signs first and requests the documents afterwards is unlikely to meet the deadline. The authority documents should be in Turkey, translated, before anyone signs.

A standard contract also remains a live filing after notification. Under the Guide, a change in the recipients listed in the annexes, or in a processor’s subprocessors, requires the annex to be updated and a new notification to be made. The termination of a contract must be notified as well. A group that replaces its payroll provider or adds a hosting region has a Turkish filing to make.

Matching the Contract to the Role

The choice between the four texts follows the role each party plays in a given flow, and one group relationship often needs more than one contract. Where the parent receives employee data to decide on promotions and bonuses across the group, it determines its own purposes and the controller to controller contract applies. Where the parent only hosts the HR database and runs it on the subsidiary’s instructions, as in the Guide’s own example, the controller to processor contract is the correct one. A Turkish subsidiary that processes data for a Turkish customer and passes it to a group service centre abroad is itself a processor, and the processor to processor text applies.

The controller to processor contract asks the parties to choose between two subprocessing models. The importer either obtains the exporter’s specific prior written authorisation for each subprocessor or works from an approved list and notifies changes early enough for the exporter to object. Each subprocessor must be bound in writing by the same safeguards and listed in an annex. For a parent that uses a dozen software vendors across the group, only the general authorisation model is workable in practice, and it brings the duty to notify annex changes with it.

Annex I of each contract records the activities of the parties, the categories of data subjects and data, the legal basis, and the frequency and purposes of the transfer. It also records retention periods, the recipients and the exporter’s registration details in VERBİS, the Turkish registry of data controllers. The VERBİS entry and the annex should describe the same transfers, and a discrepancy between them is easy for the Authority to identify. Because most of these flows concern employees, the transfer review sits naturally alongside the employment law work on personnel files and employee privacy notices.

Binding Corporate Rules

Binding corporate rules allow data transfers among the members of a group engaged in joint economic activity once the Board has approved them under Article 9(4)(b) of the KVKK. A group headquartered abroad must designate a Turkish member to file the application. Approval does not certify each individual transfer, and the exporter remains responsible for every flow meeting the requirements of the KVKK. The Guide records that the three applications filed before June 2024 were all rejected for procedural and substantive deficiencies. In our view binding corporate rules justify the effort only for groups with several Turkish entities and a large number of recurring flows. For a group with one or two Turkish companies, standard contracts achieve the same result sooner and can be in place within weeks.

Incidental KVKK Data Transfers and Their Limits

Article 9(6) of the KVKK allows data transfers without an adequacy decision or an appropriate safeguard only where they are incidental, and the Guide reads that word narrowly. A transfer that happens once or a few times, outside the ordinary course of business, may qualify. A systematic and continuously repeated transfer does not, and the Guide treats giving a recipient direct access to a database as, in principle, regular and continuous. Its examples are close to everyday group practice. Systematically sending employees’ names and job titles to a training centre abroad is not incidental. Moving payroll and HR work to another country is not necessary for the performance of the employment contract, and the Guide directs such groups to standard contracts or binding corporate rules. Sending the details of a sales manager who travels abroad to meet a client may be incidental.

Explicit consent offers no better footing for group flows. It is available only for incidental transfers and must be obtained before the transfer, after the employee has been told of the specific risks, and the employee can withdraw it at any time. Consent given by an employee to the employer is also open to the objection that it was not freely given. A subsidiary that still relies on consent forms collected before September 2024 has, in substance, no mechanism for its regular transfers.

Local Law and Access by Public Authorities

Chapter Three of the standard contracts deals with the law of the destination country. In the controller to processor text the importer confirms that no national rule or practice prevents it from complying with the contract and undertakes to inform the exporter of foreseeable changes in its law. It must also promptly notify requests from administrative or judicial authorities and any direct access by them, after which the exporter may suspend the transfers or terminate the contract. A parent company subject to broad disclosure obligations at home is therefore making a statement of fact when it signs. Its legal team should be able to support that statement with a written assessment of its own law before the contract is sent to the Authority.

Fines and Suspension Orders for Unlawful KVKK Data Transfers

Failure to notify a standard contract is fined under Article 18(1)(d) at between TRY 90,308 and TRY 1,806,177 for 2026, and the fine may be imposed on a processor as well as on a controller. A transfer made without any valid basis is unlawful processing, which the controller is obliged to prevent under Article 12(1). The more serious exposure is therefore a fine for breach of data security obligations, set for 2026 at between TRY 256,357 and TRY 17,092,242. Both ranges are revalued every January, and the Board’s fines may be challenged before the administrative courts.

The Board has already followed this route. In its decision No. 2020/173 of 27 February 2020 concerning Amazon Türkiye, the Board found, among other breaches, that transfers abroad made without a valid basis amounted to a failure of the obligations in Article 12(1). It imposed a fine of TRY 1,100,000 under Article 18(1)(b). The decision was taken under the former wording of Article 9, but the reasoning applies equally to unlawful KVKK data transfers under the current text.

For a manufacturing subsidiary the fine is often not the heaviest consequence. Article 15(7) allows the Board to order the suspension of a transfer abroad where it is manifestly unlawful and would cause damage that is difficult or impossible to repair. An order of that kind against a subsidiary whose payroll runs on the group platform puts the payroll process itself at risk. The response then becomes a matter for compliance and investigations counsel as much as for the data protection team. Group legal teams that have reviewed the personal liability of foreign directors in Turkish subsidiarieswill recognise the pattern, in which a formal obligation of the Turkish entity produces consequences well beyond it.

Before the Next Signature

The review begins with an inventory of KVKK data transfers written from the Turkish side, listing every system that holds a Turkish employee or customer record and every location from which it can be read, including support accounts held abroad. That list is then compared, contract by contract and recipient by recipient, with the standard contracts actually signed and the notifications actually filed. Where a contract is missing, the parent’s authority documents should be apostilled and translated before the draft is circulated, and the draft should state which party files the notification. This is also the moment to check the group’s European documentation against the Turkish filings, since both describe the same flows under different instruments.

A first test can be run tomorrow morning. Ask the Turkish subsidiary for the KEP receipts or module confirmations of its standard contract notifications and set them against the transfers abroad declared in its VERBİS entry. If a transfer declared there has no matching notification and the group has no approved binding corporate rules, that transfer is leaving Turkey without a filed safeguard.