Minimum Provisions To Be Included In The Undertaking To Be Submitted By the Data Controllers Before the Transfer of Personal Data to Abroad Have Been Determined
According to the Personal Data Protection Law, in principle, an explicit consent is required in order to transfer personal data to abroad. However, in the event of processing of personal data and special categories of personal data without an explicit consent, such personal data can be transferred to abroad if there is a Personal Data Protection Board (“Board”) decision stating that the foreign country in question ensures an adequate level of personal data protection (“Adequacy Decision”).
In the absence of such an Adequacy Decision, the personal data can still be transferred provided that the data controllers and the processors in Turkey and abroad commit to ensure the appropriate safeguards and the permission required by the Board.
Within this framework, minimum provisions which have to be included in the undertaking to be submitted by the data controllers and processors before the transfer of personal data to abroad have been published on the web site of the Board as of 16.05.2018. The Board, has issued different provisions for the transfers between Turkish and foreign based data controllers and between the Turkish data controller and foreign based data processors.