Personal Data Protection Authority Clarifies The Procedures For Cross Border Data Transfers With A Guideline

Introduction

The Article 9 of the Law No. 6698 on the Protection of Personal Data ("Law") on cross-border data transfer was amended with the publication of the Official Gazette dated 12 March 2024. These amendments entered into force on 1 September 2024, raising new questions for the Turkish data protection community. On 2 January 2025, the Turkish Personal Data Protection Authority ("Authority") shared the Guideline on Cross Border Transfer of Personal Data ("Guideline") with the public to eliminate these question marks and create standardization in practice.

The Guideline consists of seven chapters in total, with the first three chapters consisting of introduction, definitions and abbreviations respectively. First, cross-border transfer of personal data is covered in general and then three levels of transfer methods are included. The methods are as follows: (i) Adequacy decision, (ii) appropriate safeguards and (iii) exceptional transfers.