Board Approves Cross-Border Transfer via Non-Treaty Agreement
On 10 November 2025, the Personal Data Protection Authority (“Authority”) announced that an evaluation had been made regarding the non-treaty agreement between the Directorate General of Migration Management and the United Nations High Commissioner for Refugees (“UNHCR”) within the scope of Article 9/4(a) of the Personal Data Protection Law (“Law”) and Article 11 of the Regulation on Cross-Border Data Transfers (“Regulation”), which constitutes the legal basis for an international data transfer.
In this context, the Board allowed the transfer based on the aforementioned assessment.
The permission involves a non-treaty agreement, representing one of the new “appropriate safeguard” mechanisms introduced by the amendment to the Law on 12 March 2024 for transfers to jurisdictions that do not have an adequacy decision.
The operational framework for this mechanism was further detailed in the Regulation published on 10 July 2024. The Board’s decision is one of the first concrete uses of this new transfer mechanism.
Successful