Cross-border data transfer rules under Data Protection Law

Introduction

The Data Protection Law, Turkey's first dedicated general data protection law, was published in the Official Gazette on April 7, 2016^[1]. The law regulates the transfer of personal data in two categories: the transfer of personal data and the transfer of personal data abroad.

Article 8 of the law sets out the general principles for the transfer of personal data in Turkey to third parties. The law provides no exceptions for group companies. As a result, personal data cannot be transferred within groups without the explicit consent of the data subject. Secondary legislation and the Personal Data Protection Board may shed light on the matter. Article 9 sets out the general principles regarding the transfer of personal data abroad. Personal data cannot be transferred abroad without the explicit consent of the data subject. However, Articles 8 and 9 of the law establish exemptions regarding the transfer of personal data inside or outside the country.