Announcement from the Turkish Data Protection Authority on Turkish SCCs!

The Turkish Data Protection Authority (Authority) published an announcement (Announcement) regarding some procedural issues with respect to Turkish standard contracts (SCCs) last week. Similar to EU SCCs, Turkish SCCs are instruments to be used for data transfer abroad. (You can access the Announcement here, available only in Turkish).

As you may know, shortly after the beginning of 2025, the Authority published the long-awaited Guideline on Transferring Personal Data Abroad. However, although this guideline provided some answers to questions arising from the practical implementations of data transfer abroad, it did not address certain procedural issues, particularly regarding the signing of the SCCs and submission of the same to the Authority (You can access our note on the Guideline here, available in English).

With this Announcement, the Authority has provided some explanations on certain procedural issues that were not included in the previously published guideline. We have briefly summarized the key takeaways from the Announcement:

Retroactive Effective Dates Are Not Accepted!

Draft SCCs were published shortly before the end of the transition period of the amendment to the Turkish Data Protection Law (DP Law) on data transfer abroad. Due to the many uncertainties regarding the singing and submission of the SCCs, many data controllers were unable to finalize the processes of signing and submission of the SCCs by the end of the transition period.

In practice, legal professionals found a practical solution to minimize the risks arising from this delay by including a note in the SCCs stating that “the SCCs would be effective from the date the amendment came into force”. Indeed, the Authority has not explicitly opposed to this approach in the meetings held between the Authority representatives and the representatives from various sectors, but they stated that the issue would also be assessed and decided upon by the Data Protection Board.

In the Announcement, the Authority clearly stated that no statements such as 'effective date: ...' indicating that “the SCCs would be retroactively effective can be included in the standard contracts even if the signatures are completed at a later date”. Therefore, this practice, which is widespread in the sector, seems to be coming to an end.

Our Comment: With this approach, the Authority has indicated that it will not accept a practical solution (i.e. retroactive contracts) adopted by many data controllers for the purpose of complying with the DP Law. However, we expect that the Authority will not ignore the challenges the data controllers face in terms of complying with the DP Law, that it will not adopt an overly strict approach towards the SCCs signed and notified after the transition period for the amendment, and that it will not directly impose fines over them.

The Authority Indirectly Confirmed That It Requires Wet Signatures on the SCCs!

The DP Law includes the following provision:

“The standard contract shall be notified to the Authority within five business days upon finalization of the signatures, by either the data controller or the data processor.”

In meetings held between the Authority representatives and the representatives from various sectors, Authority representatives stated that the term "signature" should be understood, in accordance with Article 15 of the Turkish Code of Obligations (TCO), as (i) a handwritten signature or (ii) a secure electronic signature (which must be obtained from licensed service providers in Turkey).

In the Announcement, the Authority stated that the signatures on SCCs must be in accordance with “the provisions regarding signatures” of the TCO, thereby indirectly confirming this approach.

In this context, considering that obtaining a secure electronic signature from licensed service providers in Turkey is a very difficult process for foreigners, the only practical method in practice is for the SCCs to be signed with handwritten signature, which means, using a wet signature.

Our Comment: The “provisions regarding signature” of the TCO, as referred to by the Authority (Article 15 of the TCO) is about the contracts, which are subject to written form requirement. In fact, freedom of form principle is the main rule in the TCO. Therefore, the principle of freedom of form will be applied unless it is explicitly stated in the laws that a contract must be concluded in written form. Since the DP Law does not stipulate any written form requirement for the SCCs, we are of the view that Article 15 of the TCO regarding signature should not be applicable to the SCCs. However, although we do not agree with the Authority’s approach to this issue, there seems to be no other way than signing SCCs with wet signatures as the Authority indirectly confirms with this Announcement that "standard contracts must be signed with wet signatures".

Turkish Version of the SCCs Must Be Signed in the Bilingual SCCs!

Another common issue that arises in practice when the SCCs are signed with foreign parties is their reluctance to sign the Turkish version of the SCCs. As a result, in practice, bilingual (in double-columned format) SCCs are often prepared, with both the Turkish and foreign language versions in parallel columns, and the signatures are placed at the very bottom, centered between and outside both columns.

The Authority clearly stated in the Announcement that both parties signing the SCCs must have their signatures on the Turkish text, and that in double-column formats, the signatures of both parties must be in the column containing the Turkish version of the SCCs. Hence it seems important for signatories of SCCs to be mindful of this expectation of the Authority.