The 2024 amendment fundamentally changed KVKK's cross-border transfer rules. Explicit consent alone is no longer enough; standard contracts, notification duties and sector-specific localisation rules now shape cloud architecture decisions directly.
"Does our data have to stay in Turkey?" is one of the questions we hear most often in cloud projects. The answer is usually "not all of it, but some of it definitely does." The 2024 amendment changed the rules for transfers abroad, and many transfers companies make without noticing now carry a compliance burden. This article summarises what changed, which data genuinely has to stay in Turkey, and a practical architectural approach.
What Changed in 2024?
Law No. 7499 rewrote Article 9 of the Turkish Personal Data Protection Law (KVKK), published in the Official Gazette on 12 March 2024. The Regulation on the Procedures and Principles for Transferring Personal Data Abroad then took effect on 10 July 2024. The key difference: transfers based on explicit consent, previously the most common route, are no longer a valid stand-alone basis for regular transfers after 1 September 2024.
Three Routes Under the New Regime
- Adequacy decision: the Board decides that a country or sector provides adequate protection. As of this writing, relying on this route is not practical for most companies.
- Appropriate safeguards: the standard contract published by the Board, binding corporate rules, or a written undertaking approved by the Board. For most companies today, the standard contract is the route that works.
- Incidental transfer: a narrow route for irregular, exceptional cases. Using a SaaS product every day is not "incidental."
Standard Contract Essentials
- The text published by the Board cannot be modified; only the blank fields are completed.
- The contract must be notified to the Authority within 5 business days of all signatures being completed. The Authority provides an online module for this notification.
- Failure to notify carries an administrative fine; for 2026 it ranges from TRY 90,308 to TRY 1,806,377.
Transfers Happen More Often Than You Think
Many companies say "we don't send data abroad," but an inventory tells a different story. Each of the following is a personal data transfer if the provider's servers are abroad:
- Email and office applications hosted abroad
- CRM, HR, accounting or helpdesk software (SaaS)
- Backups stored in a region outside Turkey
- Customer texts, documents and records sent to AI services
- Web analytics, advertising and email marketing tools
Where Localisation Is Mandatory
KVKK does not prohibit transfers abroad; it makes them conditional. The real "must stay in Turkey" requirements come from sector regulations:
- Banking: BDDK rules require banks to keep their primary and secondary information systems in Turkey.
- Payment and e-money institutions: Central Bank (TCMB) rules similarly require information systems to be kept in Turkey.
- Public institutions: Presidential Circular No. 2019/12 and the Information and Communication Security Guide require critical public data to be kept in Turkey.
- Health data: as special-category personal data, it triggers additional security measures and specific health-sector rules.
If you operate in, or serve, one of these sectors, your customer's contract very likely includes a domestic hosting requirement too.
A Practical Classification
- Must stay in Turkey: data under sector-specific requirements; data belonging to public-sector customers; customer data whose contract requires domestic hosting.
- Should stay in Turkey: special-category personal data (health, biometric, etc.), core customer databases, employee records.
- Can be processed abroad with safeguards: anonymised data, test and development data, business data in global SaaS tools covered by a signed standard contract.
Architecture Recommendation: Separate Your Data into Layers
The healthiest approach is neither "everything in Turkey" nor "everything in a global cloud," but a layered architecture. The application and database layer holding personal data stays in Turkey. Only the data that is needed, ideally anonymised or pseudonymised, goes to services abroad such as AI models or analytics. This lets you use flexible global services while narrowing the scope and risk of transfers.
Checklist
- Mark the hosting country of every system in your personal data inventory.
- Identify the legal basis (standard contract, etc.) for every provider that transfers data abroad.
- Check that signed standard contracts were notified within 5 business days.
- Update your privacy notices with the recipient groups data is transferred to.
- List the localisation requirements in sector regulations and customer contracts.
- Add a transfer assessment to procurement before adopting any new SaaS or AI tool.
Domestic Hosting with CloudRUX
CloudRUX delivers virtual server, backup and disaster recovery services from data centres in Turkey and holds ISO/IEC 27701 privacy information management certification. We can classify together which of your data must stay in Turkey and design your architecture accordingly. Contact us at info@cloudrux.com for an assessment.
This article is for general information and does not constitute legal advice. Please consult a legal adviser about your specific situation.