Changing or Ending a KVKK Standard Contract: Parties, Transfer Information and Notification

Identify the change to the live transfer

The transfer must first be mapped as it actually operates. Article 4 of the Regulation on Procedures and Principles for Overseas Transfers of Personal Data includes sending personal data to a controller or processor abroad and making them accessible in another way. A change in the recipient, access structure, processing role or affected dataset therefore requires attention even when the commercial service keeps the same brand name.

Compare the current operation with the executed standard contract and its annexes. Identify the exporter, importer, relevant data subjects, categories, legal grounds, purposes, duration, security measures and subsequent recipients. Record the proposed change and its effective date. This comparison distinguishes a contact-detail correction from a replacement legal entity or an expansion into processing that was never described in the original safeguard.

Article 9 of Law No. 6698 remains the governing statutory framework. The underlying Article 5 or Article 6 processing condition and the applicable transfer requirements must continue to be satisfied. Our guide to Article 9 and the standard-contract route explains initial selection and execution. The question after signature is whether the instrument still covers the real parties and operations, and which changes must be notified.

Separate fixed clauses from completed information

Article 14(3) of the Regulation requires the standard contract text to be used without modification and provides that the Turkish text prevails where the contract is also concluded in another language. This rule protects the prescribed safeguards. It must be read alongside Article 14(8), which expressly anticipates changes to information and explanations supplied by the parties and requires notification of those changes.

The Authority’s standard-contract compliance announcement confirms that only the choices or alternatives permitted by the published form can be adjusted within the mandatory clauses. It does not permit deletion of a data subject’s rights, substitution of a weaker security promise or addition of an exemption that contradicts the model. Correcting the factual annexes is different from renegotiating the protection the Board prescribed.

The controller-to-processor model illustrates the relationship. Clauses 1(c) and 1(d) tie the contract to the transfer described in Annex I and make the annexes part of the contract. Clause 5 gives the standard contract priority over conflicting provisions in other agreements between the parties. A revised master services agreement consequently cannot be assumed to override the standard contract’s return, security or data subject protections merely because it was signed later.

Check party changes and signature authority

Article 14(4) requires the contract to be concluded between the transfer parties and signed by those parties or persons authorised to represent and sign for them. Identify the legal entity on each side before treating a corporate reorganisation as an administrative update. A changed company name, a transfer to another group entity and replacement of the service provider are legally different events. The supporting corporate documents must establish which event actually occurred.

A notification of changed details does not, by itself, establish that a new importer has become bound by all mandatory safeguards. Confirm the legal instrument and valid authority binding the actual parties, using the appropriate published model. Do not replace a name in a previously signed PDF and present the result as a newly executed contract. Preserve the original version and the documents establishing the change and the new parties’ commitments.

The Authority’s announcement requires consistency between party names in the contract and supporting authority documents. It also requires the named signatories’ representation and signature authority to be evidenced. Foreign official documents must meet the applicable authentication rules, taking account of treaty exemptions or apostille arrangements, and the required notarised Turkish translations must accompany foreign-language documentation. Where the contract is also executed in another language, the announcement requires both parties to sign the Turkish text, including its column in a bilingual version. The documentation review concerns the actual jurisdiction and instrument, not an assumed identical route for every country.

Where the parties conclude a new standard contract, Article 14(5) links its notification to completion of signatures. Record both signature dates and the authority in force when each person signed. The Authority expressly rejects inserting a retrospective effective date to present a contract signed later as operating earlier. A new signature cannot simply be used to conceal an earlier period during which the actual transfer lacked the claimed safeguard.

Update transfer details and safeguards

Article 14(1) identifies matters addressed by the standard contract, including data categories, purposes, recipients, technical and organisational measures and additional measures for special-category data. These are substantive descriptions of the protected transfer. Review them when a service adds new data, changes processing purposes or expands access. The assessment must establish both the accuracy of the description and the underlying lawfulness of the expanded processing.

In the official controller-to-processor Standard Contract 2, Clause 6 locates the transfer details in Annex I. Clause 7.1 requires the importer to act on the exporter’s instructions, and Clause 7.2 limits processing to the purposes specified there. A new commercial feature should therefore be checked against the documented instructions and purposes before additional employee or customer data are made accessible.

Annex II records the relevant technical and organisational measures, including additional measures where special-category data are transferred. A changed technical arrangement must be assessed for continuing adequacy, not merely reflected in a new diagram. Article 12 of Law No. 6698 continues to apply, and Clause 7.6 of Model 2 requires the importer to check regularly that the measures still provide an appropriate level of security.

The review also needs to identify consequences for the processing inventory and notices. A transfer description that now identifies a different recipient or purpose must be reconciled with the information provided under Article 10 and any registry information affected. Updating a contract annex and updating VERBIS are different legal operations. Our VERBIS and representation guide explains the registry framework; one notification should not be treated as automatically completing the other.

Manage subprocessor and recipient changes

Model 2 Clause 8 provides two alternative arrangements for subprocessors. Under specific authorisation, the importer needs the exporter’s prior specific written permission. Under general authorisation, the model requires advance written notification of additions or replacements and sufficient opportunity for the exporter to object. The parties complete the applicable advance-notice period in the permitted contractual field. It should not be confused with the Authority’s separate statutory notification timetable.

Both alternatives require an updated Annex III and notification to the Authority when subprocessors change after the original contract has been notified. Record the selected authorisation arrangement, the proposed subprocessor, its activity and the evidence that the applicable authorisation process was followed. A vendor’s publication of a revised online list does not establish that every contractual requirement has been met.

Clause 7.8 separately addresses onward transfers and requires updating Annex I and notifying changes in subsequent recipients or recipient groups after notification of the contract. Article 9(8) of the Law also preserves the relevant safeguards for onward transfers. Distinguish a new subprocessor acting under the importer’s instructions from a separate controller receiving data for its own purposes, because their roles affect the applicable legal and contractual requirements.

Model 2 also requires a written subprocessing agreement carrying the specified safeguards, and provides for the importer’s responsibility towards the exporter for the subprocessor’s obligations. The exporter should keep the information necessary to understand that chain. An updated list without the relevant processing function, authorisation and contractual protection leaves a material part of the transfer arrangement unexplained.

Complete the required notification

Article 14(8) expressly covers changes in one or both parties, changes in information and explanations entered by the parties, and termination of the standard contract. It directs notification under the procedure in Article 14(5). Paragraph 5 establishes the five-business-day notification framework and permits physical delivery, registered electronic mail or other methods determined by the Board. The current Authority announcement also identifies the Standard Contract Notification Module.

For a newly executed contract, the stated trigger is completion of signatures. For a change or termination, retain the operative event and its date and address the notification through the paragraph 5 procedure without delay; do not treat the absence of a fresh original-contract signature as eliminating Article 14(8). The notification should clearly identify the earlier contract and the particular event being reported, together with the documents establishing it.

Paragraph 5 allows the parties to identify which of them will perform notification. If they do not, the exporter notifies. That allocation should remain clear when a provider or contact changes. Paragraph 6 requires evidence of the signatories’ authority and notarised translations of foreign-language documents. The actual filing should include the complete relevant instrument and attachments; retaining them internally is not equivalent to submitting them.

Preserve the notification as submitted, its delivery confirmation and the reference linking it to the original filing. Keep the superseded version readable in the internal record so a later review can establish what applied at a particular date. An edited current document without version history makes it harder to determine whether a transfer occurred under the old arrangement, the changed arrangement or an interval requiring separate attention.

Distinguish suspension, termination and continuity

Model 2 Clause 15 requires the importer to inform the exporter immediately if it cannot comply with the contract. Where the importer breaches or cannot comply, the exporter suspends transfers until compliance is restored or the contract ends, subject to the model’s specific provisions concerning national law and public-authority access. A commercial preference to continue the service does not remove this contractual safeguard.

Clause 15(c) gives the exporter a termination right where compliance is not restored within a reasonable period and, in any event, within one month after suspension. It also identifies substantial or persistent breach and failure to comply with relevant court or Board decisions. In these situations the exporter informs the Board. The one-month rule is not a general right to continue an unlawful transfer for a further month, nor does its wording create automatic termination without the relevant assessment.

Clauses 13 and 14 separately address changes in national law or practice affecting compliance and public-authority requests or direct access. They require immediate information to the exporter and provide the specified suspension or termination rights. A notification filing alone does not resolve those substantive concerns. Assess whether the actual safeguards remain effective and whether a different lawful arrangement is available before continuing transfers.

Return or destroy data under the applicable model

Model 2 Clause 7.4 addresses the end of processing on the exporter’s behalf. At the exporter’s choice, the importer returns all such personal data with backups or completely destroys them. Clause 15(d) addresses the consequences of termination under Clause 15(c) and likewise provides for return or destruction at the exporter’s choice. Identify which provision applies to the actual ending of the relationship and give a documented instruction.

The model also addresses legislation preventing immediate fulfilment of that obligation. The importer undertakes to continue complying with the contract, protect confidentiality and process only to the extent and for the period required by that legislation. Destruction must be documented, and the contract’s protections continue until return or complete destruction. A general assertion that backups remain does not establish the legal basis, extent or duration of continued retention.

Verify the outcome against the actual systems and subprocessing chain. A closed user account does not prove that all imported records and backups were returned or destroyed. Record what remains, why, who can access it and when the relevant obligation ends. These provisions concern Model 2; the parties must read the actual published model governing their relationship rather than assume identical clause numbering and consequences in every model.

The exporter’s instruction should identify the datasets and the chosen outcome clearly enough for the importer to implement it. A return record should establish what was received and whether it remains usable for the lawful purpose. A destruction confirmation should identify its scope, including the treatment of backups. Any remaining legal retention must be distinguished from an incomplete technical task so the continuing obligations can be monitored.

Preserve the legal and operational record

The completed file should connect the commercial event with its data-protection consequences: original contract, changed parties or annexes, authority documents, notification, operational access changes and return or destruction evidence. Article 14(7) provides for Board examination under Article 15 where the published contract text is modified or a valid signature of either transfer party is missing. Accurate paperwork must therefore be matched by a valid underlying instrument.

Notification is a required act, not a certificate that every transfer is lawful. The change review should establish what stopped, what continues, the safeguard covering continuing operations and the responsibility for outstanding obligations. This enables a later reviewer to assess the entire transition without treating either a fresh filing or a termination email as proof that all statutory and contractual duties were completed.

Frequently asked questions

1. Must a change of standard-contract parties be reported?

Yes. Article 14(8) expressly requires notification when the parties change, following the procedure in Article 14(5). The actual new party must also be validly bound by the applicable safeguards.

2. Can the parties freely revise the mandatory clauses?

No. Article 14(3) requires the published text to be used without alteration. The Authority permits only the choices or alternatives provided by the official form. Factual annex updates do not authorise weaker mandatory protections.

3. Does changing a company name always mean a new legal entity?

No. Examine the corporate documents. A name change, merger and replacement provider are different events. The record must identify the actual parties and the legal effect of the change.

4. Does Article 14(8) cover termination?

Yes. Termination is expressly included. Record its operative date and notify under the paragraph 5 procedure. Ending the commercial service does not itself establish that this notification was made.

5. Who normally submits the notification?

Article 14(5) allows the parties to allocate the duty in the contract. If they make no allocation, the exporter notifies. Keep that responsibility clear during any change of provider or personnel.

6. Can a new subprocessor be added without reviewing the contract?

Model 2 Clause 8 requires the applicable specific or general authorisation process. The subprocessor list must be updated and changes notified to the Authority. The selected advance-notice and objection arrangements also matter.

7. Can transfers continue for one month after noncompliance is found?

The one-month provision does not create that permission. Model 2 Clause 15(b) requires suspension for breach or inability to comply; Clause 15(c) addresses the separate termination right where compliance is not restored.

8. Does termination require deletion of all records immediately in every case?

Read the applicable model and event. Model 2 provides return or complete destruction at the exporter’s choice and addresses legislation preventing immediate fulfilment, with continuing protection and tightly limited processing.

9. Can a replacement contract be backdated to cover old transfers?

The Authority’s announcement rejects retrospective effective-date wording where signatures were completed later. Earlier transfers require their own legal assessment; a later document does not automatically cure them.

10. Does notifying the Authority prove the changed transfer is lawful?

No. Notification is one obligation. The parties must still satisfy processing conditions, transfer requirements, valid execution, security and the substantive duties of the applicable standard contract.