Without an adequacy decision, controllers and processors may transfer abroad where an Article 5 or 6 condition is met, data subjects keep enforceable rights and effective remedies in the destination, and one safeguard exists: a non-treaty agreement between public bodies or international organisations and Turkish public bodies or public professional organisations, with Board approval; binding corporate rules approved by the Board for a group of undertakings in joint economic activity; a standard contract published by the Board (data categories, purposes, recipients, the importer's technical and organisational measures and extra measures for special categories); or a written undertaking ensuring adequate protection, with Board approval. The standard contract must be notified to the Authority by the controller or processor within five business days of signature; failing to notify is fined TRY 50,000 to 1,000,000 (base amount, revalued yearly) on the controller or on private-law processors (Article 18(1)(d)). The Regulation on the Procedures and Principles for Transfer of Personal Data Abroad (Official Gazette 10 July 2024) and the Board's standard contract templates and BCR forms implement this.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.