TÜRKIYE Law and Practice Contributed by: Bora Yazıcıoğlu, Yağız Soymen, İbrahim Yıldırım and Ezgi Girenay, YAZICIOGLU Legal
ever, under the Convention Abolishing the Require - ment of Legalisation for Foreign Official Documents, documents from signatory countries are exempt from this process, and an apostille is sufficient. Occasional Transfers If data transfers abroad cannot occur with an adequa - cy decision, and if one of the appropriate safeguards cannot be ensured, the data transfer abroad is pos - sible if the transfer is occasional and one of the legal bases laid down for occasional transfer is met. The By-law on Data Transfers Abroad defines occa - sional transfers as “transfers that are not regular, occur only once or a few times, are not continuous, and are not in the ordinary course of business”. Examples, largely based on EDPB guidelines, are provided in the Guidelines on Transfers Abroad. When relying on explicit consent for an occasional transfer, the data subject must be informed of the specific risks, including that the destination country may not provide adequate protection or implement sufficient security measures. This may involve the absence of a supervisory authority or guarantees for data processing principles and individual rights. Onward Transfers It should be noted that the requirements regarding personal data transfer abroad also extend to onward transfers conducted by either controllers or proces - sors. Other Regulations The DP Law states that provisions on data transfers abroad in other laws are reserved. The Guidelines for Good Practices on Personal Data Protection in the Banking Sector emphasise that specific provisions outlined in the Banking Law should be considered when transferring information that constitutes client secrets abroad. Likewise, the By-law on Measures for Preventing Money Laundering and Financing of Terrorism provides details on the required information that must be included in an international e-transfer, adding further compliance obligations for financial institutions.
Sectoral regulations imposing specific restrictions regarding data transfers abroad should also be con - sidered. 5.2 Government Notifications and Approvals As detailed under 5.1 Restrictions on International Data Transfers , data transfers abroad can occur through the implementation of appropriate safeguards and, except for SCCs, these safeguards require the DPA’s prior approval. Furthermore, without prejudice to the provisions of international agreements, in cases where the interest of Türkiye or the data subject will be seriously harmed, personal data may only be transferred abroad with the permission of the DPA. The DPA must obtain the opinions of relevant public institutions and organisa - tions before it grants its permission. Sector-specific regulations may also require further notifications or approvals. For instance, under the Regulation on Geographic Data Permissions, trans - ferring geographic data is subject to the authorisation from the Ministry of Environment, Urbanisation, and Climate Change. In the health sector, the transfer of personal health data is subject to the evaluation of the Ministry of Health under the By-law on Personal Health Data. Similarly, in the civil aviation sector, airline operators or institutions may share passenger information with third countries upon request under the Turkish Civil Aviation Law, provided that they obtain approval from the Ministry of Interior. 5.3 Data Localisation Requirements While there is no standalone legislation governing data localisation, certain sector-specific regulations do apply. Key sectors include: Banking and Finance Entities The following entities must keep their primary and secondary information systems in Türkiye: • banks; • payment institutions and electronic money institu - tions; • insurance and private pension companies;
525 CHAMBERS.COM
Powered by FlippingBook