Personal Data Protection Board has recently permitted for Cross-Border Data Transfer by Undertaking
Turkish Data Protection Board (“Board”) announced that the letter of undertaking application was submitted by Turksport Spor Ürünleri San. Tic. Ltd. Şti. (“Decathlon Turkey”) for cross-border transfer of personal data has been accepted under Article 9 of the Turkish Personal Data Protection Law numbered 6698 (“Law”) on 23.06.2021. The data controller is permitted to conduct cross-border data transfer to a foreign country where sufficient protection is not provided. The announcement has been published on the official website of the Board.
Data controllers shall comply with Article 9 of the Law for cross-border data transfers between data controllers, or, between the data controller and data processor. As per Article 9 of Law, unless explicit consent is obtained from the data subject, data controllers are required to guarantee sufficient protection in writing (“undertaking”) and get authorization of the Board to conduct cross-border data transfers to where sufficient protection is not provided.
Board determined the minimum elements and main conditions that must be included in the undertakings with Decision No. 2018/33 dated 02.04.2018. The undertakings in line with the Decision numbered 2018/33 have been foreseen for the bilateral transfers between the data controllers, but they may remain incapable of providing a practical implementation for the data transfer between multinational group companies. For this reason, the Board has specified “Binding Corporate Rules” as a new undertaking method for the group companies and announced its details on 10.04.2020.
Also, the Board announced the significant points to be considered while preparing undertakings for cross-border transfer of personal data on 07.05.2020, and, key procedural and substantive problems raised in requests for approval to transfer data abroad are clarified.
Data controllers should specify the relation between the parties of the cross-border data transfer accurately and use the correct form published by the Board by evaluating the aspects of the planned data transfer abroad while getting prepared for an undertaking application.