- within Energy and Natural Resources, Employment and HR and Environment topic(s)
A. Introduction
Technological developments, the widespread use of cloud-based services, the operation of companies within multinational group structures and the increasing reliance on service providers located abroad have made cross-border transfers of personal data an integral part of companies’ day-to-day business activities.
Against this background, Article 9 of the Law on the Protection of Personal Data No. 6698 (the “Law”), titled “Transfer of Personal Data Abroad”, was substantially amended by Law No. 7499, published in the Official Gazette on 12 March 2024. The amendments entered into force on 1 June 2024. Subsequently, the Regulation on the Procedures and Principles Regarding the Cross-Border Transfer of Personal Data (the “Regulation”) was published and entered into force on 10 July 2024.
The new framework introduced a three-tier system for cross-border data transfers based on adequacy decisions, appropriate safeguards and exceptional transfer cases. Accordingly, the previous regime, which in practice relied heavily on obtaining the explicit consent of data subjects, was replaced with a broader transfer framework that includes alternative mechanisms such as Standard Contractual Clauses and Binding Corporate Rules.
Therefore, companies should assess not only whether explicit consent has been obtained from data subjects, but also the nature and frequency of the transfer, the legal status of the parties involved and the appropriate transfer mechanism applicable to each specific data flow.
B. Cross-Border Transfer of Personal Data
a. Concept of Cross-Border Data Transfer
Under the Regulation, a cross-border transfer of personal data is defined as the transmission of personal data by a data controller or data processor subject to the Law to a data controller or data processor located abroad, or otherwise making such personal data accessible to them.
Accordingly, personal data do not necessarily have to be physically transferred from Türkiye to another country for a transfer to occur. Granting remote access to persons located abroad or storing personal data on cloud infrastructure located abroad may also constitute a cross-border transfer of personal data where the relevant conditions are met. The Authority’s Guidelines further state that remote access from abroad may constitute a transfer even where the personal data are merely displayed on a screen.
Therefore, companies’ e-mail systems, cloud storage services, human resources applications, customer management systems and databases shared among group companies should also be reviewed from a cross-border data transfer perspective.
b. Applicable Framework for Cross-Border Transfers
Article 9 of the Law establishes a three-tier mechanism for transferring personal data abroad.
As a first step, it should be determined whether the Personal Data Protection Board (the “Board”) has issued an adequacy decision in respect of the relevant foreign country, a specific sector within that country or an international organisation. Where an adequacy decision exists, personal data may be transferred abroad provided that one of the processing conditions stipulated under Articles 5 or 6 of the Law is also satisfied.
In the absence of an adequacy decision, cross-border transfers may be carried out based on one of the appropriate safeguards, provided that a processing condition under Articles 5 or 6 of the Law is satisfied and data subjects have the opportunity to exercise their rights and seek effective legal remedies in the country to which the personal data are transferred.
The appropriate safeguards provided under the Law include:
- the existence of an agreement that does not constitute an international treaty between relevant public authorities or international organisations, subject to the Board’s approval;
- Binding Corporate Rules approved by the Board;
- execution of the relevant Standard Contractual Clauses published by the Board; or
- a written undertaking containing provisions that ensure adequate protection, subject to the Board’s approval.
Where neither an adequacy decision nor an appropriate safeguard is available, a cross-border transfer may only be carried out on an occasional basis where one of the exceptional circumstances specified under the Law applies.
c. Transfers Based on Standard Contractual Clauses
One of the most important appropriate safeguard mechanisms for companies in practice is the use of Standard Contractual Clauses. Standard Contractual Clauses are model contracts whose content is determined by the Board and which are executed between the data controller or data processor transferring the personal data and the data recipient located abroad.
These contracts include provisions on matters such as the categories of personal data, the purpose of the transfer, data recipients, technical and administrative measures, additional safeguards for special categories of personal data, and subsequent transfers.
The Board has provided for four different types of Standard Contractual Clauses depending on the legal status of the parties to the transfer. Therefore, before the contract is executed, it is important to correctly determine whether the data exporter and the data recipient act as a data controller or a data processor.
No separate prior authorization from the Board is required for transfers based on Standard Contractual Clauses. However, the Standard Contractual Clauses must be notified to the Authority within five business days following the completion of the signatures of the parties. Failure to comply with this notification obligation is subject to an administrative fine under the Law.
Therefore, merely executing the Standard Contractual Clauses is not sufficient for companies; the notification period must also be monitored, the signing authorities must be verified, and the annexes to the contract must be completed in a manner consistent with the specific transfer activity.
In addition, it is important that the categories of personal data, groups of data subjects, purposes of the transfer, retention periods, and technical and administrative measures specified in the Standard Contractual Clauses accurately reflect the actual data flow. Where the data exporter is subject to an obligation to register with VERBIS, the information included in the Standard Contractual Clauses must also be consistent with its VERBIS records.
d. Binding Corporate Rules and Written Undertakings
Binding Corporate Rules (“BCRs”) are another appropriate safeguard mechanism, particularly relevant for regular and systematic transfers of personal data between companies belonging to the same group of undertakings.
BCRs constitute a set of personal data protection rules applicable to transfers from a data controller or data processor established in Türkiye to a data controller or data processor located abroad within the same group of undertakings.
In order to rely on BCRs, an application must first be submitted to the Board and the relevant BCRs must be approved by the Board. This mechanism may therefore be particularly suitable for multinational groups that regularly share employee, customer or supplier data among group companies.
Another appropriate safeguard available under the Law is a written undertaking containing provisions ensuring an adequate level of protection. Unlike SCCs, transfers based on a written undertaking require the Board’s prior approval before the relevant personal data may be transferred abroad.
e. Exceptional and Occasional Transfers
Where no adequacy decision is available and none of the appropriate safeguards can be implemented, personal data may nevertheless be transferred abroad in certain exceptional circumstances specified under the Law. However, such transfers must be occasional.
An occasional transfer is a transfer that is not regular, occurs only once or a limited number of times, is not continuous and does not take place in the ordinary course of business.
Accordingly, transfers made through a cloud service that is continuously used by a company or regular transfers to a foreign group company cannot generally be treated as occasional transfers. The Authority’s Guidelines expressly clarify that transfers taking place in the ordinary course of business do not qualify as occasional transfers.
Exceptional circumstances include, among others, the explicit consent of the data subject after being informed of the potential risks of the transfer, the necessity of the transfer for the performance of a contract, overriding public interest, the establishment, exercise or protection of a right and the protection of the life or physical integrity of a person.
Therefore, explicit consent should no longer be treated as a general mechanism for regular cross-border transfers under the current framework. It may only be relied upon within the scope of exceptional transfers where the transfer is occasional and the relevant requirements under the Law are satisfied.
C. Conclusion
The amendments introduced by Law No. 7499 significantly changed the legal framework applicable to cross-border transfers of personal data in Türkiye by establishing a tiered system based on adequacy decisions, appropriate safeguards and exceptional transfer cases.
Companies should first identify their existing data flows and determine what categories of personal data are transferred, for what purposes and to which persons or entities. This assessment should cover not only personal data directly transmitted to foreign companies but also data stored on cloud systems located abroad and personal data that can be remotely accessed from outside Türkiye.
In the absence of an adequacy decision, SCCs, BCRs and written undertakings may be used as appropriate safeguards. In particular, when relying on SCCs, companies should ensure that the appropriate SCC template is selected, the annexes accurately reflect the actual data flow and the executed SCC is notified to the Authority within five business days following completion of the signatures.
On the other hand, exceptional transfer mechanisms, including explicit consent, should not be relied upon as a legal basis for regular or continuous cross-border data transfers. Such mechanisms may only be used where the transfer is occasional and the specific conditions prescribed by the Law are satisfied.
Ultimately, compliance with the rules governing cross-border transfers of personal data is not limited to the execution of a particular agreement. Companies should regularly review their data flows, accurately determine the respective roles of the parties to the transfer, select the appropriate transfer mechanism and implement the necessary technical, administrative and contractual safeguards as a whole.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
