The Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad ("Regulation") entered into force after being published in the Official Gazette dated July 10, 2024 and numbered 32598.
Unlike the draft regulation that was announced to the public last May, the scope of the notification obligation of the parties of the standard contract has been expanded in the Regulation. Accordingly, although the obligation to notify the Personal Data Protection Authority ("Authority") by the methods specified in the Regulation within five business days following the execution of the standard contract remains, the Authority must also be notified in the event of a change in the parties or the content of the standard contract or the termination of the standard contract. Other provisions are accepted as stated in the draft regulation.
In addition, the comments received on the draft standard contracts and binding corporate rules, which were published for public consultation, have been reviewed by the Authority and the standard contract texts and binding corporate rules application forms to be used in the transfer of personal data abroad and the auxiliary guidelines on the basic principles to be included in the binding corporate rules have been officially approved as announced on the website of the Authority as of today except for the slight changes mentioned below:
- In the applications to be made by real person data controllers and data processors with the binding corporate rules application form, the name, surname, address, signature of the person authorised to apply, as well as certifying documents that he/she is authorised to sign, must be attached.
- For the applications to be made by legal entities or through a representative with the binding corporate rules application form, the original or certified copy of the power of attorney must also be attached to the application form.
- According to the approved standard contracts, the data transferor must undertake that it has made reasonable efforts to determine that the data recipient is capable of fulfilling its obligations arising from the relevant contract by taking appropriate technical and organisational measures.
You can access our previous information note with our detailed explanations regarding the draft regulation and documents here.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.