The rapid development of information, communication and data processing technologies in today’s globalized world brings its own challenges with regard to the governance of personal data. In this connected world, personal data can flow between entities and across borders effortlessly. This leads governments to take regulatory measures focusing on data transfers. Turkey is no exception when it comes to regulating data transfers strictly. Furthermore, various amendments in this respect have yet to be passed, potentially easing compliance requirements of the data controllers.

How does Turkey govern data transfers?

The main legal instrument in Turkey concerning personal data is the Turkish Data Protection Law (Turkish DPL).

Domestic transfers

Pursuant to Article 8 of the Turkish DPL, the domestic transfer of personal data can be carried out in one of the following ways:

• The data subject has given his/her explicit consent as per Article 8/1; or
• One of the legal bases (e.g., performance of contract, legitimate interest, legal obligation, etc.) set forth under Article 5/2 of the Turkish DPL is present; or
• For the transfer of special categories of personal data; one of the legal bases set forth under Article 6/3 of the Turkish DPL is present, and sufficient measures have been taken.

Cross-border transfers

The rules are stricter for cross-border transfers of personal data under the Turkish DPL. As opposed to the EU’s General Data Protection Regulation (GDPR), the Turkish DPL does not recognize a mechanism for transfers of personal data by relying on Standard Contractual Clauses (SCCs). As per Article 9 of the Turkish DPL, cross-border data transfers can be carried out if one of the following conditions is met.

• Consent: The data subject has given his/her explicit consent which must be specific, freely given, informed, and given with an affirmative act (e.g., by clicking “yes”); or
• Safe Countries List: (i) one of the legal bases set forth under Article 5/2 or Article 6/3 of the Turkish DPL is present, and (ii) the country to which data will be transferred is listed by the Turkish Data Protection Authority (Turkish DPA) as a safe country (Safe Country); or
• Turkish DPA Approval: If the country where the data will be transferred is not considered a Safe Country under the Turkish DPA, (i) one of the legal grounds set forth under Articles 5/2 and 6/3 of the Turkish DPL must exist, (ii) the parties must commit in writing that the transfer is concluded under an adequate level of protection, and (iii) the Turkish DPA has approved the transfer. There are two mechanisms for obtaining such approval:

• Written Undertaking: The data controller and recipient may apply to the Turkish DPA by committing in writing that the transfer will be concluded under an adequate level of protection. Please note that the Turkish DPA published a template undertaking letter that data controllers must use within this process, and the scope of this undertaking letter is very similar to the GDPR’s SCCs.
• Binding Corporate Rules (BCR): The data controller can apply to the Turkish DPA by drafting BCR, which are a set of bespoke rules to be drafted for each company involved in the intra-group data transferring activities.

Failure to comply with above-mentioned rules may result an administrative fine from TRY 40,179 to TRY 2,678,863 (approx. US$2,200 to US$144,000) (for 2022). Furthermore the Turkish DPA may instruct data controllers to cease all cross-border data transfer activities carried out in violation with the Turkish DPL and delete all transferred data within this scope.

Practical challenges for cross-border data transfers

No Safe Country

The Turkish DPA is yet to announce the Safe Countries List. As a result, currently all countries are deemed as not providing an adequate level of protection. Furthermore, there are only a handful of written undertaking approvals by the Turkish DPA, and it usually takes a few years for such approval process to be completed.

Limited options and risk assessment

In the absence of a Safe Countries List, there is no established market practice for how to carry out cross-border data transfers. Currently data controllers may do the following:

1. Obtain the data subject’s explicit consent—which can be impractical, and the DPA could still challenge the validity of such consent;
2. Apply to the Turkish DPA to obtain approval—which is a prolonged and burdensome process; or
3. Take the risk of adopting a wait-and-see approach until the Turkish DPL has been amended.

New projected amendment to Turkish DPL

In March 2021 the Turkish President announced the “Human Rights Action Plan.” One of the overarching aims of this action plan includes harmonization of the Turkish DPL with EU standards to ensure the protection of private life in the processing of personal data. It was also announced in the new economic plan that the Turkish DPL’s provisions on cross-border data transfers will be amended according to the GDPR. It is expected that these amendments will help businesses overcome the problems arising from compliance with cross-border data transfer rules. Therefore, further amendments are expected in relation to the principles governing cross-border data transfers. While there was an unofficial announcement stating that the amendment should be enacted this year, no official statement has been made in this respect.

This article has been co-authored by Kağan Dora (kdora@baseak.com), Bora İkiler (bikiler@baseak.com), Neslihan Kasap (nkasap@baseak.com), Hazal Durak, Ramiz Arslan (rarslan@baseak.com), Naz Semercioğlu (nsemercioglu@baseak.com).