UPCOMING DEADLINE FOR INTERNATIONAL DATA TRANSFER MEASURES

With reference to our Newsletter dated 28 June 2024 and titled “Amendments to the Personal Data Protection Code Have Entered Into Force”, where we informed you about significant amendments to the Turkish Data Protection Law, we would like to inform you that by 1 September 2024, data controllers and processors must ensure that at least one of the following measures is in place for the international transfer of personal data, in the absence of an adequacy decision by the Personal Data Protection Board (the “Board”, in Turkish, “Kişisel Verilerin Korunması Kurulu”):

• The existence of an agreement concluded by foreign public institutions or organizations and Turkish public institutions or professional organizations, approved by the Board,
• The existence of binding corporate rules,
• The existence of a standard contract declared by the Board; notification must be made to the Personal Data Protection Authority within five (5) business days regarding the conclusion of the standard contract. Failure to notify may result with an administrative fine ranging from TRY 50,000 (approx. EUR 1,400) up to TRY 1,000,000 (approx. EUR 28,500),
• The existence of a written undertaking approved by the Board.

Additionally, foreign data controllers processing personal data in Türkiye must register with the Data Controllers’ Registry Information System (“VERBİS”) through a representative appointed in Türkiye, as required by the Regulation on Data Controllers Registry.

For further guidance or information, please also refer to our Newsletter dated 12 July 2024 and titled “New Regulation on Transfer of Personal Data Abroad”.

Our Law Firm remains at your disposal for any further clarifications you may need.

Copyright © 2024 Cailliau&Colakel Attorney Partnership, All rights reserved.