Amendments to Türkiye’s Personal Data Protection Law No. 6698 (KVKK), introduced by Law No. 7499, come into force today, bringing the country’s cross-border transfer rules closer to the GDPR model.
Key points
- Standard contracts are introduced for cross-border transfers.
- Standard contracts must be notified to the Authority within 5 business days.
- Binding corporate rules and adequacy decisions are recognised.
- Rules on sensitive data processing are revised.
UK organisations transferring personal data from Türkiye, including to UK head offices or cloud providers, should review their transfer arrangements and put the new standard contracts in place where needed.
Source: Law No. 7499 amending the KVKK (Resmî Gazete)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
