The Draft Regulation About Cross-border Transfer Of Personal Data, Turkish Standard Contractual Terms And Binding Corporate Rules Guidelines

Within the framework of the amendments to the Turkish Personal Data Protection Law (the "Law"), which will come into force on 1 June 2024, the draft regulation on cross-border data transfer was being expected and has now published by the Turkish Personal Data Protection Authority (the "DPA") for commentary from public in general.

For consideration of data controllers and data processors, major issues set forth under the draft regulation are as follows:

Cross-Border Transfers Subject to Adequacy Decisions: As it is known, within the framework of the amendment to the Law, it has been stipulated that an adequacy decision can be made not only for a country, but also for one or more sectors within a country or an international organization. The Law also specifies what should be considered by the DPA when issuing an adequacy decision. The draft regulation also allows the Personal Data Protection Board (the "Board") to make further determinations in terms of adequacy