On 25 October 2024 the Personal Data Protection Authority ("Authority") announced the establishment of its "standard contract notification module".1 Accordingly, standard contracts within the scope of data transfer abroad may now be submitted to the Authority through this module.
Recent amendments to Article 9 of Law No. 6698 on the Protection of Personal Data ("Law") made standard contracts one method of complying with data transfer abroad regulations. Standard contracts, which provide appropriate safeguards data controllers and data processors can utilize, must be submitted to the Authority within five business days of signing. The Regulation on the Procedures and Principles Regarding the Data Transfer Abroad, which entered into force on 10 July 2024 under the Law, states that standard contracts may be submitted physically, by registered electronic mail, or by other methods determined by the Personal Data Protection Board ("Board").
The Board stated that the module has been designed so data controllers and data processors can fulfill their notification obligations in a faster and more efficient manner.2
A module user guide3 for data controllers and processors has also been published. Keep following us for further developments in both Turkish and global personal data protection law.
Footnotes
1. https://kvkk.gov.tr/Icerik/8043/Standart-Sozlesme-Bildirim-Modulu-Hakkinda-Kamuoyu-Duyurusu (Only in Turkish).
2. The Board's decision (17.10.2024, 2024/1793).
3. https://standartsozlesme.kvkk.gov.tr/sharedFolder/kullanim-kilavuzu.pdf?v=190123456 (Only in Turkish).
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
