An amendment (“Amendment”) to the Turkish Data Protection Law numbered 6698 (“DPL”) has been published in the Official Gazette dated March 12, 2024, and numbered 32487. The Amendment was published within Articles 33 to 36 of the Law on Amending the Criminal Procedure Law and Other Laws numbered 7499 and you may access the Turkish text of the Amendment here.

As a background, since the enactment of the DPL in 2016, one of the most critical problems that companies face in practice has become cross-border transfer of personal data. As the challenges experienced by the market players due to impracticalities related to the cross-border transfer regime envisaged under the DPL, both foreign investors and local stakeholders raised their concerns. As to these concerns, in the last years the government has been announcing that it had started working amending the DPL for harmonization with the GDPR via various policy documents. As a result, the Amendment entered into the Grand National Assembly of Turkey’s agenda to amend cross-border transfer regime as well as certain other provisions complicating the business life and commercial transactions in Turkey.

The Amendment which had been expected for some time within this scope has finally been published in the Official Gazette and is set to take effect on June 1, 2024.

The most important change the Amendment introduces is a new mechanism consisting of the execution of standard contractual clauses published by the Turkish Data Protection Authority (“TR DPA”) and making a notification, without the need for obtaining an approval, to transfer personal data abroad.

Please see the key details of the Amendment below.

Article 6 (Processing of Special Categories of Personal Data)

The Amendment introduces new exceptions to the explicit consent requirement for processing of special categories of personal data, without making any distinguishment between health and sexual life data and other special categories of personal data.

These new exceptions which are in line with the respective provisions of GDPR include situations where processing is necessary for the establishment, exercise or defense of legal rights or where processing is necessary for complying with legal obligations in the fields of employment, occupational health and safety, social services and welfare. Also, existing legal ground for processing of health data with certain limited purposes (e.g., preventive medicine, prevention of public health, and etc.) by authorized institutions/organizations and those who are under the secrecy obligation remains effective as a legal processing ground under the Amendment.

Article 9 (Cross-border transfers)

The Amendment introduces revisions regarding cross-border transfers of personal data to align with Chapter 5 of the GDPR. According to the Amendment, both data controllers and data processors in Turkey will be able to engage in cross-border transfers of personal data lawfully by utilizing the following mechanisms:

• Adequacy decisions: Transfer of personal data to a country, specified sector within that country or an international organization will be possible in the existence of (i) any of the legal bases indicated under Article 5 and 6 (such as legitimate interest or contractual necessity) and (ii) an adequacy decision adopted for the country to which data will be transferred, or a specified sector within that country or an international organization to which the transfer shall be made.
• Appropriate safeguards: If there is no adequacy decision adopted by the TR DPA, transfers of personal data abroad can still take place if (i) one of the conditions set forth under Article 5 and 6 (such as legitimate interest or contractual necessity) is present, (ii) the data subject has the means to exercise their rights and to have recourse to effective legal remedies in the recipient country and (iii) the parties have provided one of the following appropriate safeguards provided under the DPL.
• The safeguards mentioned within the Amendment include, (i) executing binding corporate rules approved by the TR DPA, (ii) execution of standard contractual clauses to be published by the TR DPA and notifying the TR DPA within 5 business days of execution of these clauses, and (iii) existence of a written contract whose provisions are sufficient enough to ensure adequate level of protection and approval of such written contract by the TR DPA.

• Transfers for specific situations: In addition to above, the Amendment enables transfers of personal data abroad even if there are no adequacy decisions nor appropriate safeguards. Accordingly, in the absence of an adequacy decision or of appropriate safeguards, personal data can be transferred outside Turkey based on various legal grounds such as the explicit consent of the data subject or processing being necessary for the performance of a contract provided that such transfers will not be repetitive (i.e., if the transfers will only take place one time or a few times).

According to the Amendment, a new regulation regarding the implementation of the rules on cross-border transfers will be published by TR DPA as well.

Furthermore, the Amendment states that the rules regarding cross-border transfers set out under Article 9 shall also be applicable to onward transfers and it emphasizes that unlike the current regime under Article 9 of the DPL, that data processors shall also be liable for cross-border transfers of personal data.

Additionally, as the regime for relying on explicit consent for cross-border transfers was amended a transitional clause was included in the Amendment. According to the Provisional Article 3 added to the DPL, after the Amendment takes effect in June, controllers may keep relying on explicit consent as a legal basis for cross-border transfers, until September 1, 2024. However, after that date, the new regime foreseen under the Amendment will be applicable for engaging in cross-border transfers.

Article 18 (Misdemeanors and Jurisdiction)

The Amendment introduces a new type of misdemeanor for failing to notify the TR DPA within 5 business days of the execution of the standard contractual clauses to be concluded for cross-border transfers, for both data controllers and processors.

The Amendment also introduces a special provision stating that administrative courts shall have jurisdiction over the disputes arising out of administrative fines imposed by the TR DPA. However, it is envisaged that the cases pending before the criminal courts of peace as of June 1, 2024, shall continue to be heard by these courts.