Controllers and processors may transfer personal data abroad where an Article 5 or 6 condition is met and the Board has issued an adequacy decision for the country, sectors in it or the international organisation. Adequacy decisions are issued by the Board, published in the Official Gazette, reviewed at least every four years and may be amended, suspended or revoked prospectively; the Board weighs reciprocity with Türkiye, the recipient's legislation and practice, an independent and effective supervisory authority with remedies, membership of data protection conventions and organisations, membership of organisations Türkiye belongs to, and conventions Türkiye is party to. The pre-2024 first paragraph (explicit consent, or adequate protection or written undertakings with Board permission) ran in parallel until 1 September 2024 (Provisional Article 3).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.