Turkish Startup Ecosystem Quarterly Legal Update – Q1 2024

You may find the legislative changes concerning the Turkish startup ecosystem in the first quarter of 2024 below.

1. Amendments to the Personal Data Protection Law

Pursuant to the Law No. 7499 on the Amendment of the Code of Criminal Procedure and Certain Laws ("Amending Law"), published in the Official Gazette dated 12.03.2024 and numbered 32487, introduced significant amendments to the Personal Data Protection Law ("Law") regarding the processing of special categories of personal data, the transfer of personal data abroad and the administrative fines imposed by the Personal Data Protection Board ("Board"). The Amending Law has increased the harmonisation of personal data protection legislation with the European Union General Data Protection Regulation.

(i) Processing of Special Categories of Personal Data

Prior to the Amending Law, it was regulated that special categories of personal data could be processed with explicit consent. However, special categories of personal data, except for data concerning health and sexual life, could be processed without seeking explicit consent of the data subject, in the cases provided for by laws. Personal data concerning health and sexual life could only be processed, without seeking explicit consent of the data subject, by the persons subject to secrecy obligation or competent public institutions and organizations, for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services as well as their financing.

With the Amending Law, the system stipulating the rules and exceptions that special categories of personal data cannot be processed without explicit consent has been completely changed. Instead, the scope of exceptions to the processing of special categories of personal data has been expanded in line with the general data processing grounds and the GDPR. Accordingly, it is regulated that special categories of personal data may be processed in cases where one of the following conditions is met:

1. The data subject has given explicit consent.
2. It is expressly provided for by the laws.
3. It is necessary for the protection of life or physical integrity of the person himself/herself or of any other person, who is unable to explain his/her consent due to the physical disability or whose consent is not deemed legally valid.
4. Processing relates to personal data which are manifestly made public by the data subject and is in accordance with his/her will to make it public.
5. Processing is necessary for the establishment, exercise, or protection of any right.
6. Processing is necessary for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services as well as their financing provided by the persons subject to secrecy obligation or competent public institutions and organizations.
7. Processing is necessary for the fulfilment of obligations regarding employment, occupational health and safety, social security, social services, and social assistance.
8. Processing is carried out by a foundation, association or any other not-for-profit body with a political, philosophical or trade union aim in accordance with its purposes and the legislation to which it is subject and that the personal data are not disclosed outside that body without the consent of the data subjects and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it.

As stated in the general preamble and the preamble of the relevant article, the needs encountered in practice regarding the processing of special categories of personal data have also been taken into consideration. Accordingly, for instance, the fact that the employer can continue to store the health data of its former employee in order to exercise the right of defence in lawsuits that may be filed after the termination of the employment agreement, or that special categories of personal data such as blood type and previous illnesses can be processed for the purpose of protecting the life or physical integrity of a person who is unable to explain his/her consent due to loss of consciousness for any reason, can be considered as positive developments.

(ii) Transfer of Personal Data Abroad

Prior to the Amending Law, it was regulated that personal data could be transferred abroad with explicit consent. However, personal data could be transferred abroad without explicit consent of data subject upon the existence of one of the conditions of the general data processing or one of the conditions for the processing of special categories of personal data other than health and sexual life. Adequate protection is required in the country where the personal data are to be transferred. If adequate protection is not provided, the existence of commitment for adequate protection in writing by the data controllers in Türkiye and in the relevant foreign country and authorisation of the Board were required.

With the Amending Law, the system stipulating the rules and exceptions that personal data cannot be transferred abroad without explicit consent has been completely changed. Instead, it is regulated that in the presence of one of the general data processing conditions or special categories of personal data conditions and by providing one of the additional conditions gradually and by providing one of the additional conditions gradually explained below, personal data transfer abroad is permitted without explicit consent.

1. Firstly, it is required that the Board has issued an adequacy decision on the third country, international organisation, or a specified sector within that third country. The Board will take into account criteria such as reciprocity, rules and protection mechanisms in the place of transfer, and international conventions when making an adequacy decision.
2. In the absence of an adequacy decision made by the Board, it is required that the controller or processor should provide appropriate safeguards such as commitment, binding corporate rules, standard data protection clauses, etc., provided that enforceable data subject rights and effective legal remedies for data subjects are available in the country where the personal data are to be transferred.
3. Finally, in the absence of an adequacy decision, or of appropriate safeguards, transfer may be made on an incidental basis. However, it should be noted that this provision permits transfers to be made once or several times in certain compulsory cases listed in the Law, such as performance of a contract, superior public interest.

As stated in the general preamble and the preamble of the relevant article, the needs encountered in practice regarding the transfer of personal data abroad have also been taken into consideration. Accordingly, it has been pointed out that prior to the Amendment Law, the adequate protection commitment was not frequently applied, and the data transfer became dependent on obtaining explicit consent. This situation has made it almost impossible to legally use cloud-based software and applications, which are frequently used by almost every company and real person in commercial life and whose servers are located abroad and has become an obstacle to investments in the country. The amendments are intended to solve these problems.

(iii) Administrative Fines

Prior to the Amending Law, it was regulated that administrative fines imposed by the Board could be appealed to the criminal courts of peace. However, it was known that a significant portion of the applications made to the criminal courts of peace were not subject to inadequate judicial review due to workload and specialisation. In a recent Constitutional Court decision, the decision of violation on the grounds of insufficient examination brought the drawbacks of the appeal to the criminal courts of peace back to the agenda. The Amending Law regulates that administrative fines imposed by the Board may be appealed to administrative courts and thus aims to eliminate this issue.

The Amending Law introduces a new misdemeanour. As mentioned above, in the absence of an adequacy decision, personal data transfer abroad is permitted provided that there are effective remedies and one of the appropriate safeguards. The standard data protection clauses, which is listed among the appropriate safeguards, is regulated for the first time in the Law. If standard data protection clauses are signed, the controller or processor shall notify the Personal Data Protection Authority within five days. In case of breach of this notification obligation, the controller or processor will be imposed an administrative fine from TRY 50,000 to TRY 1,000,000.

(iv) Effective Date

The amendments regarding the transfer of personal data abroad will enter into force on 01.09.2024. Thus, it is possible to transfer data abroad for three more months based on the explicit consent obtained before or after the entry into force of the Amendment Law.

The appeals pending before the criminal courts of peace as of 01.06.2024 against the administrative fines imposed by the Board will be finalised by these judgeships.

2. Amendment Regarding Pension Mutual Funds' Ability to Invest in Venture Capital

The Capital Markets Board amended the Guidelines on Pension Mutual Funds. With this amendment, those who are included in the private pension system will be able to prefer to accrue interest on their investments in venture capital funds. Accordingly, at least one per cent of their portfolios shall be directed to venture capital investment funds' participation shares. The minimum venture capital investment rule shall be met until 30.06.2024.

3. Default Interest Rate to be Applied in Late Payments in the Supply of Goods and Services

Pursuant to the Communiqué on the Default Interest Rate to be Applied in Late Payments in the Supply of Goods and Services and the Minimum Expense Amount that can be Requested for the Collection Costs of Receivables was published by the Central Bank of the Republic of Türkiye, in cases where the default interest rate for late payments made to the creditor in the supply of goods and services regulated under Article 1530/7 of the Turkish Commercial Code is not stipulated in the contract or the relevant provisions are invalid, the interest rate to be applied was determined as 48% per annum, and the minimum amount of expenses that can be requested for the collection of the receivable is determined as TRY 1,310. The aforementioned ratio and amount entered into force on the date of publication, effective from 01.01.2024.

4. Minimum Equity Amount of Payment Services has been Increased

Communiqué on Redetermination of Minimum Equity Amounts of Payment Institutions and Electronic Money Institutions has been published. According to the Communiqué, the minimum equity amounts shall be increased to (i) TRY 10,000,000 for payment institutions intermediating invoice payments, (i) TRY 55,000,000 for electronic money institutions, and (iii) TRY 20,000,000 for other payment institutions, except for payment institutions providing the service of providing consolidated information on online platforms regarding the payment accounts. These amendments shall be entered into force on 30.06.2024.

5. Developments in the Tax Regulations

Dividends received from participation shares of the venture capital funds and investment funds, income generated from the refund of these funds' participation shares and value increase gains of the participation shares of these funds' have been exempted from the corporate tax. With the Law No. 7456, abovementioned income and gains related to investment fund participation shares except for those related to venture capital funds are excluded from this exemption.

Both legal and real persons participating in foreign joint stock and limited liability companies whose legal and business centre is not located in Türkiye are exempted from income or corporate tax at a rate of 50%, provided that they held at least 50% of the paid-up capital of the foreign subsidiary and that the dividends are transferred to Türkiye until the date of submission of the tax return for the accounting period in which the income is received.

It was regulated that 50% of the income obtained by legal and real persons from the services provided abroad in the fields of architecture, engineering, design, software, medical reporting, bookkeeping, call centre, product testing, certification, data storage, data processing, data analysis, education and health services can be deducted from income or corporate tax at a rate of 50%, provided that all of the income obtained are transferred to Türkiye until the date when the tax return should be submitted. This deduction rate has been increased to 80%.

It was regulated that the depreciation period to be applied to the machinery and equipment acquired by companies located in Technopolis and R&D and Design Centres to be used exclusively in R&D, innovation and design activities can be calculated over half of the current useful life period. This application has been extended until 31.12.2024.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.