Two-Minute Recap Of Recent Developments In Turkish Personal Data Protection Law

In May, the Turkish Data Protection Authority ("Authority") published a draft regulation and draft documents, approved two written undertakings, and announced 13 data breach notification.

Draft Regulation open for public comments

On 9 May 2024, the Draft Regulation on the Procedures and Principles Regarding the Cross-Border Transfer of Personal Data ("Draft Regulation") was opened for public comments (until 20 May 2024).

The Draft Regulation provides alternative cross border transfer mechanisms for data controllers and processors. Within their scope, personal data may be transferred abroad without explicit consent provided there is compliance with one of the three following conditions: (i) Existence of an adequacy decision, (ii) existence of the appropriate safeguards, (iii) in the absence of the prior two conditions, applicable specific derogations.