The Personal Data Protection Authority (“the Authority”) has announced the launch of a new application for the notification of standard contracts used in the transfer of personal data abroad, in accordance with Article 9 of the Personal Data Protection Law No. 6698 (“PDP Law”), through a public announcement (“Announcement“) published on the Authority’s website on October 25, 2024.
As is known, with the amendment made to Article 9 of the PDP Law by the Law No. 7499 on the Amendment of the Code of Criminal Procedure and Some Laws, “standard contracts” have been stipulated as an appropriate safeguard method that data controllers and data processors can utilize for the transfer of personal data abroad, and the notification of these contracts to the Authority has been made mandatory.
Pursuant to the PDP Law and the Regulation on Procedures and Principles for the Transfer of Personal Data Abroad, standard contracts must be notified to the Authority within five business days of their signing. These notifications can be submitted physically, via registered electronic mail (known as “KEP“) address, or by other methods determined by the Personal Data Protection Board (“Board”).
As a result, the Authority has developed the “Standard Contract Notification Module” to enable data controllers and data processors to fulfill their notification obligations online in a faster and more efficient manner. This module, implemented with the decision of the Board dated 17.10.2024 and numbered 2024/1793, has been made available to the relevant parties.
The Authority has also published a Guide for data controllers or data processors who will make the notification, to provide detailed information on using the Standard Contract Notification Module. This guide includes step-by-step instructions and screenshots on how to use the module.
Accordingly, to effectively use the Standard Contract Notification Module, data controllers and data processors must first register with the system and verify the email address or phone number they provide.
Following these steps, an authorized person must be added to perform actions such as adding contracts and adding parties. The Guide already details how to add authorized persons, how to add contracts, and how to make the necessary notifications. Moreover, an authorized person will be able to conduct such process by providing an authorization document stating that they are authorized to upload contracts to this module on behalf of the data controller/processor.
With this new module, standard contract notifications can now be easily made online. Data controllers or data processors, where relevant, are expected to fulfill their obligations using this new module.
Please find the full text of the Announcement at the following link:
https://kvkk.gov.tr/Icerik/8043/Standart-Sozlesme-Bildirim-Modulu-Hakkinda-Kamuoyu-Duyurusu
This Legal Alert has been prepared for general information purposes only on current legal issues, and the evaluations contained in this Legal Alert do not constitute legal advice or a legal opinion. It is not possible to impose any liability on SRP-Legal Law Office due to the content of this Legal Alert. It is recommended to obtain the opinion of a legal advisor regarding your questions and enquires within the scope of this Legal Alert.
