The Personal Data Protection Authority (the “Authority“) has commenced the public consultation process on the “Draft Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad” (the “Draft Regulation“) with the publication of the announcement on 9 May 2024 on the Authority’s website (“Announcement”).
This initiative follows the publication of Law No. 7499 on the Amendment of the Code of Criminal Procedure delzand Certain Laws in the Official Gazette on 12 March 2024, numbered 32487, which will come into force on 1 June 2024, introducing significant amendments to the processing of special categories of personal data and the transfer of data abroad.
Under Article 9 of the Personal Data Protection Law No. 6698, which governs the international transfer of data, it is stipulated that the procedures and principles for implementing the article shall be established through secondary regulations.
Within this framework, Authority prepared the “Draft Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad”. Subsequently, with the Decision of the Personal Data Protection Board dated 9/5/2024 and numbered 2024/762, it is envisaged to receive the opinions of the public regarding the Draft Regulation until the date of 20 May 2024.
The Draft Regulation defines data transmitter and data receiver for the first time.
The Draft Regulation is prepared to apply to data controllers and data processors who are parties to the transfer of personal data abroad, and in case personal data is transferred by the data processor, it is also stipulated that the data processor must comply with the instructions of the data controller.
This obligation is also envisaged to be applied in terms of onward transfers of personal data transferred abroad and transfers to international organizations.
The Draft Regulation details the issues to be taken into consideration by the Board when making an Adequacy Decision for data transfer abroad and the issues regarding the review of the Adequacy Decision.
Under the Draft Regulation, among the transfer mechanisms to be based on Appropriate Safeguards, the minimum terms that should be included in the agreement that is not an international agreement, Binding Corporate Rules and Undertaking Letter are specified, and it is regulated that the Standard Agreement will be determined and announced by the Board.
The ‘incidental’ phrase included in the new version of Article 9 of the Law, for the transfers in the absence of an Adequacy Decision or Appropriate Safeguards is included in the Draft Regulation under the exceptional transfer cases as transfers that are not regular, occur only once or a few times, are not continuous and are not in the ordinary course of business.
Please find the complete text of the Announcement, including the Draft Regulation, General Justification, and Opinion Form, via the following link:
