TÜRKIYE Law and Practice Contributed by: Bora Yazıcıoğlu, Yağız Soymen, İbrahim Yıldırım and Ezgi Girenay, YAZICIOGLU Legal
Adequacy Decisions Adequacy decisions provide a valid legal basis for transferring data abroad. The DPA has the authority to issue adequacy decisions not only for countries but also for international organisations and specific sectors within third countries (a “Whitelist”). Adequacy decisions must be reviewed by the DPA at least once every four years. If the DPA determines that adequate protection is no longer ensured, these decisions may be amended, suspended, or revoked with prospective effect following the review, or in any other cases it deems necessary. Since the DPA has not yet established a Whitelist, alternative mechanisms for transferring data abroad must be considered in practice. Appropriate Safeguards In the absence of an adequacy decision, data trans - fers abroad can still occur through the implementation of appropriate safeguards. However, these safeguards can only be utilised if the conditions for processing personal data are met, and if it is feasible for data subjects to exercise their rights and access effective legal remedies in the third country where the data will be transferred. There are four methods to deploy appropriate safe - guards: • an agreement between “public institutions and organisations or international organisations abroad” and “public institutions and organisations or public professional organisations in Türkiye”, subject to the DPA’s approval; • binding corporate rules (BCR), subject to the DPA’s approval; • a written undertaking containing provisions that will provide adequate protection, subject to the DPA’s approval; and • SCCs announced by the DPA, with a requirement for notification to the DPA within five business days from the execution date. The By-law on Data Transfers Abroad states that notifications of SCCs can be made physically, via registered electronic mail, or through other methods determined by the
DPA. In this context, the DPA introduced an online “SCC Notification Module” in 2024. Due to the challenges in obtaining approval from the DPA, SCCs have been the most viable option in mar - ket practice. The DPA published SCCs modules that cover data transfers from (i) controller to controller, (ii) control - ler to processor, (iii) processor to processor, and (iv) processor to controller. While the English-language versions are also available on the DPA’s website, the By-law on Data Transfers Abroad clearly emphasises that if SCCs are executed in a foreign language, the Turkish version will prevail. This is further confirmed in the Guidelines on Trans - fers Abroad, stating that double-column SCCs will be considered valid by the DPA, provided that the Turkish version is properly executed. The SCCs published by the DPA must be executed without any modification, except where explicitly allowed within the relevant sections of the SCCs. While various practices emerged due to uncertainties arising from the lack of guidance, the Guidelines on Transfers Abroad provided clarifications on how to complete each section of the annexes to be filled out by the parties. For instance, while many practitioners only included the categories of personal data trans - ferred, the guidelines clarified that both the categories and the specific data transferred should be stated. The notifications should include: • the final version of the SCCs, with relevant sections filled out and signed by authorised individuals of the parties; • documents proving authority of those signing the SCCs; • notarised translations of foreign-language docu - ments. The Guidelines on Transfers Abroad also confirmed that official documents from foreign authorities can be included in the notification, with authentication of signatures, titles, or seals required. This verification is usually done by consular or diplomatic officials. How -
524 CHAMBERS.COM
Powered by FlippingBook