TÜRKIYE Law and Practice Contributed by: Bora Yazıcıoğlu, Yağız Soymen, İbrahim Yıldırım and Ezgi Girenay, YAZICIOGLU Legal
conditional release, judicial fines, or revocation of a driver’s licence are considered processing of special categories of personal data. Therefore, some interpre - tations in the sector suggest that processing criminal record documents showing a clear background (ie, no convictions) does not count as processing special categories of personal data. Processing for Job Applications The DP Law does not provide a specific regime regard - ing the processing of job applications, and general provisions apply. In this regard, personal data related to a job application can be processed without explicit consent based on the legal basis of “processing is necessary for establishment or performance of the contract”. However, the data must be stored only for the purpose of which it was processed. Data of the candidate who is not selected should be deleted after reasonable period. 4.4 Data Protection in M&A As the DP Law does not explicitly regulate M&A trans - actions, such processes are governed by the general principles of the DP Law. Key requirements can be • Legal Basis: Controllers must ensure they rely on the appropriate legal bases outlined in the DP Law when transferring personal data. • Data Minimisation: Sellers must redact or anonymise personal data whenever possible. Data-sharing should be strictly limited to what is necessary for the transaction’s valuation and legal assessment. • Data Rooms: Access must be restricted on a “need-to-know” basis. Data rooms should use pseudonymisation, redaction, or anonymisation where feasible. • Data Protection Compliance Audit: A holistic audit must be conducted to evaluate the target com - pany’s compliance with data protection laws. Notification categorised as follows: Due Diligence Phase • Data Subjects: Data subjects must be informed about the data processing and transfer activities. In cases where the transfer relies on explicit consent,
the data controller must ensure that explicit con - sent should be obtained. • VERBIS: The DPA must be informed by any chang - es of the controller’s representative or contact information. • Data Transfers Abroad: If the buyer is a foreign entity and the data is being transferred to servers outside of Türkiye, the parties must comply with the DP Law, which may require SCCs which are subject to notification to the DPA. Post-Closing Phase • Data Migration and Security: During the technical migration of databases, the buyer must implement robust technical and organisational measures, including encryption and access logs, to safeguard data confidentiality and integrity. With the DP Law Amendments, the previous system has been significantly amended. Current provisions of the DP Law foresee a gradual and alternative regime for international transfers, comprising three levels based on; • adequacy decisions; • appropriate safeguards; and • occasional causes. While the DP Law does not include a definition of “data transfer abroad”, the By-law on Data Transfers Abroad fills this gap by defining it as “the transmission of personal data by a data controller or data processor within the scope of the DP Law to a data controller or data processor abroad or making it accessible by any other means”. 5. International Considerations 5.1 Restrictions on International Data Transfers With its Guidelines on Transfers Abroad, the DPA fur - ther clarified that direct collection of personal data does not constitute data transfer under the new regime, in contrast to its previous position.
523 CHAMBERS.COM
Powered by FlippingBook