NEW REGULATION ON TRANSFER OF PERSONAL DATA ABROAD

We would like to inform you that the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad (the “Regulation”) was published in the Official Gazette numbered 32598 and dated 10 July 2024. The Regulation has come into force as of its publishing date.

Additionally, the Personal Data Protection Board (the “Board”) has announced the standard contracts (in Turkish, “standart sözleşmeler”), binding corporate rules application forms (in Turkish, “bağlayıcı şirket kuralları başvuru formu”) and supplementary guideline (in Turkish,“yardımcı kılavuz”).

The Regulation aims to determine the procedures and principles for the implementation of Article 9 of Law numbered 6698 on the Protection of Personal Data (the “Law”) concerning the transfer of personal data abroad.

Up until now, the transfer of data abroad required obtaining the explicit consent of the data subject or meeting the conditions for data processing outlined in Article 5 of the Law along with a decision by the Board confirming that the foreign country to which the data is being transferred would provide adequate protection. Additionally, if there would be no adequacy decision, data transfer would still be possible if the data controllers located in Türkiye and in the relevant foreign country provide adequate protection in writing and obtain the Board’s permission. In practice, however, since the Board has not published a list of safe countries and granted very few commitments, data transfer to abroad anyhow would only be possible through obtaining the explicit consent of the data subject.

The Regulation specifies the new procedures for transferring personal data to abroad which is, in brief, as below.

• General Provisions

Personal data may only be transferred abroad in line with the procedures and principles stated in the Law and the Regulation. The data processor will act in accordance with the instructions of the data controller and will take the necessary technical and administrative measures.

• Transfers Based on Adequacy Decision (in Turkish, “Yeterlilik Kararı”)

In order to transfer the personal data abroad, there must exist an adequacy decision regarding the relevant country or sector. The Board may decide that certain countries or international institutions provide an adequate level of data protection. The adequacy decision is reviewed every four (4) years and is amended, suspended or revoked accordingly.

• Transfers Based on Appropriate Safeguards (in Turkish, “Uygun Güvence Bulunması”)

In the absence of an adequacy decision, it is regulated that personal data may be transferred abroad if one of the appropriate safeguards listed below is provided by the parties, provided that one of the requirements set forth in Articles 5 and 6 exists, the data subject has the opportunity to exercise his/her rights and to exercise effective legal remedies in the country where the transfer will be made.

• The existence of an agreement, that is not qualified as an international agreement, between public institutions and organizations abroad or international organizations, and public institutions and organizations or professional organizations with public entity status in Türkiye, and the permission granted by the Board for such transfer,
• The existence of binding corporate rules approved by the Board including provisions concerning the protection of personal data for companies within a group engaged in common economic activities,
• The existence of a standard contract declared by the Board and notification made to the Personal Data Protection Authority (in Turkish, “Kişisel Verilerin Korunması Kurumu”) within five business days regarding the conclusion of the standard contract,
• The existence of a written undertaking including provisions ensuring adequate protection and authorization granted by the Board.
• Incidental Data Transfer (in Turkish, “İstisnai Aktarım Halleri”)

In the amended version of Article 9 of the Law, the concept “incidental” for transfers where Adequacy Decisions and Appropriate Safeguards cannot be provided is detailed in the Regulation under exceptional transfer cases as transfers that are non-regular, occur once or on seldom occasions, are not continuous, and are not part of the regular course of business activities.

The Board is authorized to address any vagueness that may arise during the implementation of the Regulation and to determine matters not explicitly addressed by the Regulation in accordance with the relevant legislation.

Our Law Firm remains at your disposal for any further clarifications you may need.

Copyright © 2024 Cailliau&Colakel Attorney Partnership, All rights reserved.