Av. Sevcen CAN & Av. Yasemin ÇORAK
In our previous articles, we explained the transfer of personal data inside Turkey (Please see…). In this article, we will explain transfer of personal data abroad.
2) Transfer of Personal Data Abroad
The Law (“LPPD”) stipulate more strict conditions for transfer of personal data abroad than those for transfer inside Turkey. Personal data may be transferred abroad in one of the following cases that;
– Explicit concent must be given by the data subject.
– The country to which data will be transferred must be approved by Board as “Adequate Country” and there must be circumstances needed for processing personal data abroad.
– If the country is not approved by Board as “Adequate Country”, it is needed data controllers in Turkey and abroad commit in writing to provide an adequate level of protection.
Concept of adequate country can be defined as country where sufficient level of protection is provided. The Board shall decide whether there is sufficient protection in the foreign country concerned and whether such transfer will be authorised, by evaluating the followings:
a) the international conventions to which Turkey is a party,
b) the state of reciprocity concerning data transfer between the requesting country and Turkey,
c) the nature of the data, the purpose and duration of processing regarding each concrete, individual case of data transfer,
d) the relevant legislation and its implementation in the country to which the personal data is to be transferred,
e) the measures guaranteed by the controller in the country to which the personal data is to be transferred.
The Board announces the countries where sufficient level of protection is provided. However, there is no adequate country announced by the Board yet.
Lastly, in cases where interest of Turkey or the data subject will seriously be harmed, personal data, without prejudice to the provisions of international agreements, may only be transferred abroad upon the permission to be given by the Board after receiving the opinions of related public institutions and organizations.
In our next article, we will be introducing the subject of rights and obligations related to personal data protection.