Sending guest data abroad: tour operators, foreign software and KVKK Article 9

A transfer abroad is any sending, storing or making accessible of personal data outside Türkiye, such as a rooming list emailed to a tour operator or a booking engine hosted abroad. Turkish data protection law treats such a transfer as a separate duty on top of the ordinary rules for processing personal data, and it allows a transfer only through the routes the law sets out, such as an adequacy decision, an appropriate safeguard, or a limited occasional route. Confirm the current routes, their conditions and your own case with a legal adviser.

A rooming list for a group of forty leaves the hotel as an email attachment to a tour operator in Germany. The same week, the booking engine, the newsletter tool and the group's shared drive all sit on servers outside Türkiye. Each of those is a transfer abroad, and each needs a route. This article explains what a KVKK cross-border data transfer is, what changed in Article 9 in 2024, what the Board's standard contract must contain and who signs it, and how to map your hotel's real flows so the paperwork matches reality.

What counts as a transfer of guest data abroad?#

A transfer abroad is any case where personal data leaves Türkiye, or is stored or made accessible outside it, whatever the mechanism: an email attachment, a hosted system, or a support login from another country. Treat this as a working definition for building a map, not as a legal opinion. Where the edges lie in your case is a question for your counsel.

The everyday cases, one by one:

• Sending. A rooming list, a reservation export or a guest message thread emailed to a tour operator or agent established abroad.
• Storing. A booking engine, channel manager, email service or backup whose servers sit outside Türkiye, even when the vendor's staff never look at your data.
• Making accessible. A group head office abroad opening a dashboard, or a vendor's support engineer abroad logging into your system to fix a ticket.

Carrying a laptop or phone with guest data to a trade fair or a sales trip is the same question in a smaller package.

Why the vendor's nationality misleads#

The vendor's registered address is not the test. A foreign-owned company hosting in Türkiye is a different case from a Turkish company hosting abroad, and only one of them is a transfer on that fact alone. What matters is where the data sits and who can reach it, not the flag on the company letterhead.

Order matters: first establish that a transfer happens, then choose the route. Choosing a contract before mapping the flow is how hotels end up with paperwork that describes the wrong thing.

What are the three routes under Article 9 since 2024?#

A transfer abroad needs one of three things: an adequacy decision, an appropriate safeguard, or a narrow occasional ground. Each of them also requires a processing condition under Article 5 or 6. This is the structure Law No. 7499 created when it rewrote Article 9 on 2 March 2024 (source: Mevzuat Bilgi Sistemi, Law No. 6698, consolidated text (opens in a new tab), 7 November 2026).

Route 1: adequacy#

The Board decides that a country, specific sectors within it, or an international organisation offers adequate protection, publishes the decision in the Resmî Gazete, and reviews it at least every four years. Check the published decision itself, not the country's general reputation. A processing condition under Article 5 or 6 must still exist.

Route 2: appropriate safeguards#

Where there is no adequacy decision, the parties supply one of four safeguards: a non-treaty agreement between public bodies or international organisations with Board permission; binding corporate rules approved by the Board; a standard contract announced by the Board; or a written undertaking with adequate protection clauses, again with Board permission. Two extra conditions apply: the data subject must be able to use their rights and effective remedies in the destination country, and a processing condition must exist.

Route 3: occasional transfers#

Where there is neither an adequacy decision nor a safeguard, seven narrow grounds remain, from explicit consent given after the person is told of the possible risks, through contract necessity and legal claims, to transfers from a public register. These are examined in the next section.

Two further points. Onward transfers, and transfers to international organisations, must also meet these safeguards under Article 9(8): a chain of recipients does not dilute the duty. And Temporary Article 3 kept the old first paragraph of Article 9 alongside the new text until 1 September 2024, so advice and templates written before that date may describe a route that no longer exists.

What does a KVKK standard contract contain, and who signs it?#

The Board publishes the text, the parties must sign it unchanged, and the last signature starts a five business day clock to notify the Authority. These rules come from Article 14 of the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, published in the Resmî Gazete of 10 July 2024, No. 32598 (opens in a new tab).

What the text must cover#

The contract must cover the data categories, the purposes of transfer, the recipients and recipient groups, the technical and administrative measures the recipient will take, and extra measures for special-category data. Use the announced text without any change. If a foreign-language version is also made, the Turkish text prevails. The signatories are the parties to the transfer, or persons authorised to represent and sign for them; a signed order form or a supplier's own data processing addendum is not the same document.

The five-day notice, step by step#

The notice goes to the Authority by the method the Authority currently requires, which may include in person, registered electronic mail (KEP) or an online notification module. Check the Authority's website for the current method and timeframe, and confirm them with your legal adviser. The parties may name one of them in the contract as the notifying party; if they do not, the exporting party notifies.

The notice must include documents proving the signatories' authority, and a notarised translation of every foreign-language document. If the text has been changed, or a party's valid signature is missing, the Board examines the case under Article 15 of the Law. Changes in the parties or in the contract information, and the end of the contract, are notified in the same way.

Why does the occasional route rarely fit a hotel's routine flows?#

Because it is built for transfers that do not recur, and a nightly availability feed or a weekly rooming list is the definition of a recurring flow. The Turkish word in the law is arızi: occasional, incidental. A flow that repeats on a schedule, to the same recipient, is the opposite of that.

Explicit consent is one of the seven grounds, but it requires telling the person of the possible risks first, and it can be withdrawn. A rooming list is usually compiled before the guest is asked anything at all. Contract necessity covers a contract between the person and the controller, or pre-contract steps taken at the person's request; whether a tour operator's booking fits that wording is a question for your counsel, not a conclusion to draw from the flow chart. The public interest, legal claims and life or bodily integrity grounds each have their own narrow scope, and none of them is a general permission for a supplier relationship.

The three questions that separate routine from occasional#

Ask of each flow: does it repeat, does it go to the same recipient, and does it cover guests who never dealt with you directly? If the answer is yes to all three, look at safeguards rather than at the occasional grounds. The occasional route is not a permanent fallback for a supplier you simply have not contracted with yet.

How do you map a hotel's real data flows?#

Start from the documents and messages that actually leave the building, then trace each one to the system and the country behind it. Collect artefacts first, systems second: rooming lists, reservation exports, guest message threads, invoices sent to agencies, shared spreadsheets, the group reporting pack.

Walk the vendor chain end to end: booking engine, channel manager, email host, CRM, review and survey tools, backup, and the support desk that can log in. Count the group: a head office abroad reading guest-level reports is a transfer, and binding corporate rules are the safeguard designed for exactly that pattern. Re-run the map when a vendor changes hosting or adds a sub-processor, and at least once a year, because hosting moves quietly.

Keep the map. It is the document your counsel will work from, and the one the standard contract's content should match. How each hotel's data stays apart in multi-tenant hotel software is a related but different question, covered in our note on multi-tenant hotel software.

The flow register, field by field#

What must guests be told about a transfer abroad?#

A transfer route is not a substitute for the duty to inform: the privacy notice should say that data is transferred abroad, to whom, and on what route. Notifying the Authority under a standard contract is a duty to the regulator. It tells the guest nothing.

Where explicit consent is the ground, the person must be told of the possible risks before consenting, which is a higher bar than a line in a notice. Keep the notice specific enough to be useful: the categories of data, the recipient groups, the countries where they are known, and the route relied on. The notice itself has a structure worth following, section by section; our template walks through it. The wider set of duties around notices, consent, staff access and retention is covered in our KVKK guide for hotels.

What changes in the notice when a route changes#

Update the notice when a route changes, for example when a supplier moves hosting to another country or a new tool starts handling guest messages. A route change is not only a contract question; it is a guest-facing question too.

What should you ask your counsel?#

Bring the flow register and the signed texts, and ask about the edges: which flows are transfers, which route fits each one, and what the notice must say. Put the questions in writing, and keep the answers with the register.

• Which of our flows are transfers abroad, and which are domestic processing by a foreign-owned vendor?
• For each routine flow, is there an adequacy decision covering that destination, and does it cover the sector the recipient works in?
• If we use a standard contract, who signs for each party, who notifies, and what proves their authority?
• Does any flow genuinely fit an occasional ground, and what would we have to tell the guest first?
• What must the privacy notice say now, and what triggers an update?

Confirm the current text, the notice method and the consequences of a missed notice with your adviser. This article describes the mechanism, not your case. Where an AI assistant or a messaging tool touches guest data, the transfer question arrives with a second set of questions about the tool itself; see AI assistants and guest data: questions for your adviser.

What to do next#

Map the flows before you choose the paperwork. Build the flow register this month from the documents that actually leave the building, mark each row as transfer or not, and take that one page to your counsel with the Board's current standard contract text. The routes only work when they sit on top of a real map and a real processing condition.