Latest Developments Regarding Personal Data Transfers Abroad

The Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad (Regulation) entered into force through publication in the Official Gazette dated 10.07.2024 and numbered 32598. Important regulations are as follows:

• Under the Regulation, data controllers and processors may transfer data abroad if (i) an adequacy decision is in place; in the absence of an adequacy decision (ii) one of the appropriate safeguards set out in Article 10 of the Regulation (such as a letter of undertaking, binding corporate rules, standard contractual clauses) is provided by the parties; and in the absence of any of these (iii) one of the exceptional circumstances (such as explicit consent, overriding public interest) exists.
• The Personal Data Protection Board (Board) may decide that a country, one or more sectors within a country, or an international organization provides an adequate level of protection for the transfer of personal data abroad. An adequacy decision shall be reevaluated in every 4 years at the latest, and this decision may be amended, suspended, or revoked with prospective effect.
• The minimum requirements for binding corporate rules are established under Article 13 of the Regulation. In case binding corporate rules are drafted in a foreign language, the Turkish version shall prevail.  Personal data transfer is initiated after the binding corporate rules are approved by the Board.
• Under Article 14 of the Regulation, standard contractual clauses shall be determined and announced by the Board and the announced texts must be used without any modification. The standard contractual clauses must be signed by the parties to the transfer or their authorized representatives.
• A signed version of the standard contractual clauses shall be notified to the Personal Data Protection Authority (Authority) within 5 business days following the date of signature. The Authority shall also be notified in case of a change in the parties or content, or termination of the contract. Documents certifying that the signatories are authorized must also be submitted during such notification.
• Article 16 of the Regulation stipulates the cases of incidental transfers abroad in the absence of an adequacy decision and failure to provide any of the appropriate safeguards. Incidental transfers are defined as transfers that are not regular, occur only once or a few times, are not continuous, and are not within the ordinary course of business. Explicit consent of the data subject or the transfer is mandatory for the performance of a contract between the data subject and the data controller are examples of incidental transfer cases.

In addition, the standard contractual clauses, binding corporate rules application forms and the guidelines for binding corporate rules were announced on the website of the Authority as per the Board’s decision dated 04.06.2024 and numbered 2024/959.

You may find the full text of the Regulation here.

You may find the announcement regarding the decision of the Board here.