Cross-border Transfers: The GDPR and KVKK Compared
In a recent blog, we compared the EU’s General Data Protection Regulation (GDPR) and Türkiye's Personal Data Protection Law No. 6698, or Kişisel Verileri Koruma Kanunu (KVKK), noting the key differences and similarities.
Below, we discuss the differences and similarities of cross-border data transfers between the 2 jurisdictions.
Similarities between the EU’s GDPR and Türkiye’s KVKK
The EU’s General Data Protection Regulation (GDPR) and Türkiye's Personal Data Protection Law No. 6698, or Kişisel Verileri Koruma Kanunu (KVKK), both pose strict regulations regarding the transfer of personal data outside of their respective jurisdictions.
In fact, both regulations forbid the transfer of personal data to jurisdictions that cannot ensure adequate protection of said data.
Safeguards Must Be Put In Place
The GDPR and KVKK require data controllers and data processors to implement appropriate safeguards to ensure personal data is being securely processed and held at all times. If the receiving country cannot guarantee the appropriate safeguards are in place or the legal framework changes in a manner that compromises these safeguards, data transfer approvals can be revoked.
Consent Must Be Given by Data Subjects
Unless the data collection falls under contractual necessity, legal obligations, public interest, or legitimate interest, data subjects must give explicit consent before the data can be collected.
Download the EU Travel Rule Overview
Differences between the EU’s GDPR and Türkiye’s KVKK
The GDPR offers more flexibility and structured mechanisms for cross-border data transfers, whereas KVKK imposes stricter control and regulatory oversight.
Adequacy Decisions per the EU
The GDPR provides different tools to frame data transfers from the EU to a third country. For example, the European Commission can issue an “Adequacy Decision.” In other words, if the European Commission deems a third country to offer adequate protection (Adequacy Decision), personal data can be transferred without additional safeguards, making it equivalent to data transfers within the EU.
If no Adequacy Decision exists, transfers require appropriate safeguards, such as Binding Corporate Rules (BCRs*) for corporate groups, Standard Contractual Clauses (SCCs**), or adherence to a code of conduct or certification mechanism with binding commitments.
If neither adequacy nor safeguards apply, transfers may still occur under specific derogations, such as the individual’s explicit consent after being informed of the risks.
The KVKK does not have an Adequacy Decision framework or similar. Instead, transfers require explicit approval from Türkiye’s Data Protection Authority (KVKK Board) unless specific exemptions apply.
*BCRs are a mechanism for multinational corporations to transfer data internationally under their corporate group while remaining compliant with the GDPR.
** SCCs are a set of standardised contracts that allow data exporters to provide appropriate safeguards.
Standard Contractual Clauses (SCCs) & Binding Corporate Rules (BCRs) per the EU
The GDPR provides Binding Corporate Rules (BCRs) and Standard Contractual Clauses (SCCs) as legal instruments to facilitate cross-border data transfers when no Adequacy Decision exists. These contractual safeguards ensure that the recipient organisation upholds GDPR-level protection.
The KVKK, on the other hand, does not explicitly provide for SCCs or BCRs as automatic mechanisms. Instead, it requires case-by-case approval from the KVKK Board for contractual agreements governing international transfers. This results in slower and more bureaucratic cross-border transfers than GDPR transfers.
Learn More about 21 Travel Rule
Regulatory Approval for Transfers
One of the strictest aspects of KVKK is that even when explicit consent is obtained from the data subject, organisations must still seek approval from the KVKK Board before transferring data abroad unless an exemption applies. This differs from the GDPR, where transfers based on SCCs, BCRs, or other legal bases do not require prior approval from a regulator.
Data Transfer Without Consent
While the GDPR requires explicit consent from data subjects, there are exceptions. Data can be shared if it falls under legitimate interests, contractual necessity, and public interest (provided it can be ensured that the appropriate safeguards are in place).
The KVKK, on the other hand, requires explicit consent from the data subject, unless the data transfer is mandated by law or approved by the Turkish Data Protection Authority.
Learn More about Türkiye's Travel Rule
The GDPR and KVKK’s Impact on Businesses and Compliance
The GDPR and KVKK work to ensure the secure transfer of personal data cross-border. However, the GDPR offers a more structured approach, making it easier for businesses with clauses like BCRs, SCCs, and Adequacy Decisions to enable cross-border data transfers.
The KVKK imposes a stricter regulatory framework, which requires explicit consent from the data subject or approval from the KVKK Board. Due to the KVKK’s stringent requirements, entities operating under both frameworks must pay closer heed to Türkiye’s requirements to avoid a breach of compliance requirements.
Learn how 21 Travel Rule is a perfect solution for crypto entities operating in both jurisdictions.
Sources:
https://www.kvkk.gov.tr/Icerik/6730/PUBLIC-ANNOUNCEMENT-ON-BINDING-CORPORATE-RULES
https://www.edpb.europa.eu/sme-data-protection-guide/international-data-transfers_en
https://www.morogluarseven.com/news-and-publications/guide-on-cross-border-data-transfers/
https://koksal.av.tr/kvkk/how-to-compliantly-transfer-data-abroad-from-turkey/
