Turkey’s Data Protection Board (“Board”) has minimum contractual clauses (“Minimum Clauses”). The Minimum Clauses address the essential clauses must be included under contracts for transferring personal data to countries which Turkey deems to not provide adequate protection. The Board is expected to announce which countries it deems to provide adequate protection in the near future. The Minimum Clauses include separate provisions for transfers to data controllers, compared to data processors.
Article 9 of Personal Data Protection Law number 6698 regulates transfer of personal data abroad. In principle, personal data must not be transferred abroad without obtaining the data subject’s explicit consent. However, personal data may be transferred outside Turkey without obtaining explicit consent if one of the conditions for processing personal data without explicit consent is present and:
- If the foreign country to which personal data will be transferred has an adequate level of protection; or
- If the data controllers in Turkey and abroad commit, in writing, to provide an adequate level of protection and the Board gives permission.
Accordingly, Turkish legislation requires a written contract for transferring personal data to countries where an adequate level of protection does not exist and the Minimum Clauses include the following provisions:
- Foreign data controllers will take the technical and administrative measures required to ensure an adequate level of security, similar to Turkish data controllers.
- If the transferred personal data is not processed in line with the agreement, the data processor will be entitled to terminate the agreement.
- Foreign data controllers and data processors will notify their Turkish counterparty if any local administrative authority makes a request regarding the transferred personal data.
- Foreign data controllers will be mutually liable for the data processor’s processing activities.
- Turkish data controllers will be entitled to audit data controllers and data processors which data is transferred to.
Please see this link for the full text of the Minimum Clauses, published on the Board’s website on 16 May 2018 (only available in Turkish).
