The LPPD distinguishes between the transfer of personal data to third parties in Turkey and the transfer of personal data to third countries.

Transfer of personal data to third parties

In principle, personal data can be transferred to third parties with the explicit consent of the data subject. The conditions and exemptions applied to collection and processing of personal data also apply to the transfer of personal data to third parties.

Transfer of personal data to parties in third countries

In addition to the conditions and exemptions applied to the transfer of personal data to third parties, one of the following conditions shall exist for transfer of data to parties in third countries:

• There is an adequacy decision, given by the Personal Data Protection Board, about the country, international organization or sectors within the country where the transfer will be made. 
• The data controllers and data processors in Turkey and in the target country shall undertake protection in writing and obtain the Personal Data Protection Board's permission; and
• Data controllers and data processors shall sign BCRs and obtain the approval of the Personal Data Protection Board.
• Data controllers and data processors shall sign standard contractual clauses that are prepared and announced by the Personal Data Protection Board and notify the Personal Data Protection Board within 5 business days following its signature. 
• Public institutions / organizations abroad or international organizations and public institutions / organizations in Turkey or professional organizations in the nature of a public institution shall execute an agreement that is not in the nature of an international agreement, and obtain the Personal Data Protection Board's approval. 

Moreover, in the absence of an adequacy decision or the appropriate safeguards, which are listed above, data controllers and data processors may transfer personal data abroad in incidental and non-repetitive manner, only in one of the following cases:

• The data subject gives explicit consent to the transfer and is informed about the possible risks of the cross-border data transfer; 
• The transfer is necessary for the performance of a contract between the data subject and the data controller; 
• The transfer is necessary for the implementation of pre-contractual measures taken upon the request of the data subject;
• The transfer is necessary for the establishment or performance of a contract between the data controller and another party for the benefit of the data subject;
• The transfer is necessary for an overriding public interest;
• The transfer is necessary for the establishment, exercise or protection of a right; 
• The transfer is necessary to protect the life or bodily integrity of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent; or
• The transfer from a registry open to the public or persons with a legitimate interest, provided that the conditions required to access the registry in the relevant legislation are met and the person with a legitimate interest requests the transfer.