Duyurular

The Turkish Data Protection Authority Updates the Publication The Law on the Protection of Personal Data in 100 Questions

The publication The Law on the Protection of Personal Data in 100 Questions has been updated and published on the official website by the Turkish Data Protection Authority.

Detailed information has been provided in the publication regarding the purpose, scope, legal basis, and areas of application of the Law on the Protection of Personal Data.

In the updated publication, explanations have been provided in summary regarding the following matters:

1.Special Categories of Personal Data

Special categories of personal data refer to data that, if disclosed, could cause the data subject to suffer harm or be discriminated against.

The legislator explicitly defines special categories of personal data through an exhaustive list that cannot be expanded by analogy. These include data related to an individual's race, ethnic origin, political opinions, philosophical beliefs, religion, sect, or other beliefs, attire, membership in associations, foundations, or trade unions, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data.

The special categories of personal data regulated under Article 6 of the Law, titled "Conditions for Processing Special Categories of Personal Data" have been preserved with the amendments introduced by Law No. 7499.

According to Article 6 of the Personal Data Protection Law special categories of personal data may be processed based on the following legal grounds:

  • Explicit consent,
  • Explicitly provided for by law,
  • Actual impossibility,
  • Public disclosure by the data subject,
  • Necessity for the establishment, exercise, or protection of a legal right,
  • Processing by persons or authorized institutions and organizations under a confidentiality obligation,
  • Processing for legal obligations in the fields of employment, occupational health and safety, labor and social security, or social services and assistance,
  • Processing by foundations, associations, and other non-profit organizations established for political, philosophical, religious, or trade union purposes, in compliance with the applicable regulations and their objectives, limited to their field of activity, and without disclosure to third parties, regarding their current or former members, affiliates, or persons who have regular contact with such organizations.

Beyond these legal grounds, special categories of personal data cannot be processed. In all circumstances, the general principles outlined in Article 4 of the Law must be complied with as a legal requirement when processing personal data.

  1. Cross-Border Transfer of Personal Data

According to the Law on the Protection of Personal Data, personal data may be transferred abroad provided that the necessary conditions are met.

Conditions for Transfer:

  • One of the data processing conditions set forth under Articles 5 or 6 of the Law must be fulfilled.
  • In addition a decision of adequacy must have been issued by the Turkish Data Protection Authority concerning the recipient country, the relevant sector within that country or the international organisation to which the data will be transferred.

Adequacy Decision:

  • An adequacy decision shall be issued by the Turkish Data Protection Authority.
  • The adequacy decision shall be published in the Official Gazette.
  • It shall be reviewed at least once every four years and may be suspended or revoked where necessary.

The Turkish Data Protection Authority shall assess whether an adequate level of protection is ensured by taking into account the following factors:

  • Whether there is reciprocity between Türkiye and the recipient country, sector or international organisation regarding the transfer of personal data.
  • The data protection legislation and its implementation in the recipient country.
  • The existence of an independent and effective data protection authority.
  • The availability of administrative and judicial remedies.
  • Whether the recipient country is a party to international conventions or a member of international organisations concerning the protection of personal data.
  • Türkiye’s international agreements and cooperation frameworks to which it is a party.

In the Absence of an Adequacy Decision, Personal Data May Be Transferred Abroad Only Under the Following Conditions:

  • An agreement executed with the authorisation of the Turkish Data Protection Authority.
  • Binding corporate rules approved by the Authority.
  • Standard contractual clauses published by the Authority.
  • A written undertaking accompanied by the authorisation of the Authority.
  • Derogations based on international agreements to which Türkiye is a party.

Note: Standard contractual clauses must be notified to the Turkish Data Protection Authority within five business days following their execution. Failure to comply with this requirement may result in an administrative fine ranging from 50.000 to 1.000.000 Turkish Liras.

Transfers in the Absence of Appropriate Safeguards (Derogations):

Where an adequacy decision has not been issued and appropriate safeguards cannot be ensured, personal data may be transferred abroad only under the following exceptional circumstances, provided that the relevant legal requirements are fulfilled:

  • The explicit consent of the data subject has been obtained.
  • The transfer is required for the performance of a contract to which the data subject is a party.
  • The transfer is required for the conclusion or performance of a contract entered into in the interest of the data subject.
  • The transfer is required for reasons of substantial public interest.
  • The transfer is required for the establishment, exercise or defence of legal claims.
  • The transfer is required for the protection of the vital interests of the data subject or another natural person, particularly in cases where the data subject is unable to provide consent due to factual or legal incapacity.
  • The transfer is carried out from a public register, provided that the conditions for access laid down in the applicable legislation are met and the requesting party has a legitimate interest.

You can access the full text of the publication here.

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr


All information and documents on our website have been prepared by Zumbul Attorneys at Law for general informational purposes only, in accordance with the Attorneyship Law, other relevant legislation and the Professional Rules of Attorneyship of the Union of Turkish Bar Associations. These publications are not intended for advertising or commercial purposes. The information and documents provided are of a general nature and under no circumstances, do they guarantee or warrant that the content is complete, accurate, up-to-date, or reliable. You should not rely on the information and documents on this website without first consulting a lawyer or expert. The links included in our website’s publications are sourced from publicly available materials and are provided solely for the convenience of visitors in accessing additional information. These links do not constitute any form of recommendation or endorsement of the linked persons, institutions or organizations. The information on this website does not in any way constitute legal advice or establish an attorney-client relationship with visitors to the site. All content on this website is the property of by Zumbul Attorneys at Law, and no content may be copied, reproduced, or used without prior written permission.