The Guidelines for International Transfer of Personal Data cover almost every aspect of international data transfers, with key highlights as follows:
- Territorial Scope: The law’s territorial scope will be interpreted based on the principle of “effect” rather than “territoriality.” In other words, the law will apply if data subjects residing in Turkey are “affected.”
- How Transfers Occur: A transfer occurs when the data controller transmits or makes personal data accessible.
- Direct Collection: The guide finally embodies the “direct collection” argument, which was already being argued in practice. It is not considered a transfer when a data subject directly transmits personal data to a company located abroad that targets the Turkish market.
- Application Numbers: As of June 1, 2024, only three applications for Binding Corporate Rules (BCR) had been submitted to the Authority, and all were rejected due to deficiencies. Eighty-six undertaking applications were submitted to the Personal Data Protection Board but only ten were accepted.
- Language of Standard Contracts: The contract must primarily be in Turkish, with a dual-column format being the accepted version for notifications.
- Verification in Notifications: Signature verification may be required to confirm that the title of the signatory or the original seal/stamp is authentic. Official document verification methods, such as apostilles, should be followed.
- Last-Resort Use of Exceptional (Incidental) Transfers: The adequacy decision or appropriate safeguards must be checked first. Exceptional transfers should only be used as a last resort.
- Conditions for Exceptional Transfers: The Authority defines “incidental transfers” as transfers outside the normal flow of operations, occurring irregularly, and under unforeseen circumstances at unspecified intervals.
- Explicit Consent for Exceptional Transfers: Consent must be obtained at the time the transfer is foreseen. It should include the identity of the data controller, the purpose of the transfer, the types of personal data transferred, the right to withdraw consent, the absence of an adequacy decision, and potential risks (e.g., lack of regulatory oversight or data subject rights) if transferred abroad.
- “Necessity” for Contract Performance in Exceptional Transfers: Transfers must have a direct, objective, close, and significant connection with the performance of a contract to meet the necessity criterion.
- Overriding Public Interest: Transfers may be justified for crime prevention and detection, national security, public health, and financial supervision involving tax and customs authorities. An international agreement or treaty signed by the country can demonstrate public interest.
- Necessity for Establishment, Exercise, or Protection of Rights: Submitting documents to a foreign authority for executing the right to defense in an investigation may fall under this scope. However, the Authority expects an assessment to determine whether the purpose can be achieved without the transfer. If anonymization is possible, it should be preferred; otherwise, only the necessary data should be transferred.
- Cases of Actual Impossibility and Invalid Consent: If the data subject is physically (e.g., due to a disability) or legally (e.g., underage) incapable of giving valid consent, and this can be concretely proven, transfers may be permitted. This also applies to emergencies where medical treatment requires data transfer.
- Conditions for Public Registers or Registers Open to Persons Having Legitimate Interest: Registers must intend to provide information to public. Registers maintained by private entities (e.g., credit bureau records) do not fall under this scope.
You may access the full text of The Guidelines for International Transfer of Personal Data from the link below.
https://www.kvkk.gov.tr/Icerik/8143/Kisisel-Verilerin-Yurt-Disina-Aktarilmasi-Rehberi
You may always contact us for detailed information and professional support regarding to compliance process.
This Legal Alert has been prepared for general information purposes only on current legal issues, and the evaluations contained in this Legal Alert do not constitute legal advice or a legal opinion. It is not possible to impose any liability on SRP-Legal Law Office due to the content of this Legal Alert. It is recommended to obtain the opinion of a legal advisor regarding your questions and enquires within the scope of this Legal Alert.
