Public Announcement on the Draft Documents Regarding Standard Contracts and Binding Corporate Rules
On 17.05.2024, the Turkish Personal Data Protection Authority (Authority) released the draft documents concerning standard contracts and binding corporate rules, which are stipulated as appropriate safeguards for cross-border transfer under the amendments to the Law No. 6698 on the Protection of Personal Data (PDPL) for public consultation and evaluation.
The Authority has published a total of four sets of draft standard contracts to be used for cross-border transfers from data controllers to data controllers, data controllers to data processors, data processors to data controllers, and data processors to data processor.
The standard contracts include provisions on general terms, obligations of the parties, obligations in case of access by national law and public authorities, and miscellaneous such as termination, applicable law, and the determination of the competent court. It is not possible to make changes to these standard clauses except for modifications permitted.
Additionally, the annexes to the standard contracts include Annex-1, where the details of the transfer (activities of the parties related to the transferred personal data, data subject groups, categories of transferred personal data, categories of transferred sensitive data, legal reason for the transfer, frequency of the transfer, nature and purposes of the processing activity, retention period or criteria for determining the retention period, recipients or group of recipients, and the data exporter’s VERBIS information) can be arranged, and Annex-2 where the applicable technical and administrative measures can be specified.
In addition to the standard contracts, a draft application form and a guide containing fundamental principles that should be included in binding corporate rules, which can be used by groups of undertakings engaged in a common economic activity (Corporate Groups), have been published. The draft documents for binding corporate rules are separated for data controllers and data processors and prepared as two different sets.
Opinions and evaluations on the draft documents can be sent to aktarim@kvkk.gov.tr until 27.05.2024.
You may access the announcement of the Authority in Turkish here.
All rights of this article are reserved. This article may not be used, reproduced, copied, published, distributed, or otherwise disseminated without quotation or Erdem & Erdem Law Firm's written consent. Any content created without citing the resource or Erdem & Erdem Law Firm’s written consent is regularly tracked, and legal action will be taken in case of violation.