Guidelines on Cross-Border Transfer of Personal Data Published

The long-awaited Guidelines on Cross-Border Transfer of Personal Data (“Guidelines”), prepared to serve as a guiding document regarding the cross-border data transfers under the Personal Data Protection Law (“Law”), was published on the website of the Personal Data Protection Authority (“DPA”) on January 2, 2025.

With the amendments made in the Law effective as of June 1, 2024, along with a three-month transition period, and the publication of the Regulation on the Procedures and Principles Regarding Cross-Border Transfer of Personal Data (“Regulation”), the Guidelines includes concrete and detailed evaluations through examples to address some ambiguities that arose during implementation. The Guidelines provides a more comprehensive explanation of the amendments made in the Law and the provisions of the Regulation.

Below is a summary of our notes on the key points explained in the Guidelines:

• Direct Collection: It was emphasized that situations where a data controller in a foreign country directly obtains personal data from data subjects in Turkiye do not constitute a cross-border data transfer in and of itself. However, such processing activities are subject to the Law and complaince with its provisions is mandatory. If the foreign data controller that directly obtains personal data from data subjects shares these data with other data controllers or processors in the foreign country, this however will be considered a cross-border data transfer under the Law. In summary, in cases of “Direct Collection” where data are obtained directly from the data subject, the rules for cross-border data transfers will not apply if the data are not transferred to other third parties abroad. However, it has been clarified that appropriate safeguards must be ensured for all onward transfers to other third parties abroad.
• Data Transfer Between Group Companies: Given the length of the approval process for binding corporate rules and the complexity of data processing workflows in multinational organizations, detailed guidance on drafting and signing standard contractual clauses, which are frequently relied upon by multinational corporations, was anticipated. However, the Guidelines does not provide extensive guidance on this matter. The Guidelines only addresses one example considering transfer of employee-related data by a Turkish subsidiary of a multinational company to its parent company abroad for storage in a centralized database. In this example, it is noted that the Turkish subsidiary processes the data in its capacity as the employer and data controller, while the parent company may be regarded as a data processor. However, it should not be overlooked that if these HR data are processed by the parent company for purposes other than storage in a centralized database, the parent company may also be considered a data controller. In practice, multinational companies commonly use standard contracts for data transfers from data controllers to data processors when dealing with systems and data centers. For processing purposes where the parent company and other foreign subsidiaries act as data controllers, standard contracts designed for data controller-to-data controller transfers are generally used.
• Transfers Based on Appropriate Safeguards: In cases where there is no adequacy decision for the country to which the transfer is made, transfers based on appropriate safeguards are detailed in the Guidelines, and key considerations regarding standard contractual clauses are thoroughly analyzed. You can review our information note on transfers based on appropriate safeguards.
• Non-Modification of Standard Contracts: It was emphasized that, except for optional or alternative clauses envisaged by the templates announced by the Authoirty, no additions, deletions, or modifications should be made to the standard contracts. The most common modification observed in practice involved additions related to the effective date. However, in our opinion, such additions are also inappropriate, and as stated in the Guidelines, it will not be acceptable for companies that fail to sign the agreements within the required timeframe to specify September 1, 2024, as the effective date, which is seen as circumvanting the law. All transfers made without standard contractual clauses after September 1, 2024, pose a risk for the data controller.
• Preparation of Standard Contracts’ Annexes: The Guidelines provides detailed explanations on how to fill in the relevant sections when preparing the annexes of standard contracts. It was underlined that the information provided by the data controller transferring the data in the annexes of the standard contract must be consistent with the VERBIS (Data Controllers’ Registry) registrations. Therefore, it is crucial for data controllers to conduct the necessary checks to ensure that standard contractual clauses do not conflict with their VERBIS records.
• The Exceptional Nature of Incidental Transfers: It was stated that exceptional transfers should be interpreted very narrowly, and priority must be given to determining whether an adequacy decision or appropriate safeguards are available. In the absence of these, exceptional transfers should only be considered as a last resort. It was underlined that incidental transfers can occur more than once; however, when assessing whether they qualify as exceptional, a cumulative evaluation must be made based on the following criteria: the transfer should not be regular, should not be continuous, should occur under unforeseen circumstances, and should take place outside the normal course of actions at uncertain intervals.

Current Status of Cross-Border Transfers as of 2024

Before the amendments, there was no effective mechanism for cross-border data transfers other than explicit consent. Indeed, data on cross-border personal data transfers prior to the amendments confirm this issue. The Guidelines notes that, 86 undertaking applications had been submitted to the Board, of which only 10 were approved so far. Additionally, it was noted that 3 Binding Corporate Rules applications were submitted; however, these were not approved due to deficiencies.

Despite the amendments, there are still deficiencies in data controllers' compliance efforts. In the information note recently published by the DPA regarding its 2024 activities, it was stated that 3 undertakings meeting the required qualifications for cross-border transfers were approved in 2024, and 1,345 standard contractual clauses were notified to the DPA.

Developments to date regarding cross-border transfers indicate that standard contracts will continue to be the most preferred safeguard by data controllers in 2025.

In light of all these considerations, data controllers must ensure the accuracy and up-to-date status of their VERBIS records and subsequently sign and submit the relevant standard contractual clauses for cross-border transfers in alignment with their VERBIS records as soon as possible. The Guidelines will serve as a valuable resource for data controllers and data processors in their preparations within this framework.

Nevertheless, the Guidelines has not fully met expectations in terms of concrete evaluations, examples, and alternative suggestions regarding issues such as the practices of multinational companies and the global systems in use. There are still unresolved matters awaiting clarification, particularly concerning whether data flows should be tracked or evaluations should be limited to the contracting parties in the context of data processing agreements. The need for more specific definitions of implementation principles, supported by examples, has yet to be addressed. Additionally, it is clear that more practical solutions are required to facilitate the involvement of data controllers, particularly those residing abroad, and data processors in the submission of standard contractual clauses.

First published by Gün + Partners in Jan 08 2024.