On March 12, 2024, the Personal Data Protection Authority (KVKK) announced amendments to the Personal Data Protection Law (the Law) through the Law on Amendments to the Criminal Procedure Code and Certain Laws, published in the Official Gazette No. 32487 (the Amending Law). Specifically, Articles 33 to 36 of the Amending Law brought changes to Articles 6, 9, and 18 of the Law, and introduced a new temporary article.

Amendments to processing of special category personal data

Article 6(3) of the Law is amended to prohibit the processing of special category personal data, except under certain conditions such as explicit consent, legal provisions, protection of vital interests, public data disclosure purposes, rights protection, and obligations related to public health and other specified fields.

Amendments to the transfer of personal data abroad

Additionally, Article 9(1) is modified to allow the transfer of personal data abroad by data controllers and processors, contingent on conditions in Articles 5 and 6 of the Law and an adequacy decision for the destination country, sectors within the country, or international organizations.

Moreover, Article 9(2) introduces changes concerning adequacy decisions issued by the Personal Data Protection Board (the Board), outlining the periodic review of such decisions and the Board's authority to modify, suspend, or revoke them. Article 9(3) of the Law is amended to emphasize factors considered in adequacy decisions, including reciprocity, legislation, data protection authority existence, and international agreements.

Article 9(4) of the Law specifies the conditions under which data controllers and data processors may transfer data abroad in the absence of an adequacy decision for personal data, provided that one of the conditions specified in Articles 5 and 6 of the Law exists, and the data subject in the country to which the transfer will be made has the opportunity to exercise their rights and access effective legal remedies. The conditions include:

• the existence of a non-international agreement of a non-binding nature between public institutions and organizations abroad and public institutions and organizations in Turkey, and permission is granted by the Board;
• the existence of Binding Corporate Rules (BCRs) approved by the Board, which contain provisions on the protection of personal data and are obligatory for companies within the business group engaged in joint economic activities;
• the existence of a standard contract covering data categories, purposes of data transfer, recipients and recipient groups, technical and administrative measures to be taken by the data recipient, and additional measures for special category personal data, as announced by the Board. The standard contract is notified to the KVKK by the data controller or data processor within five business days of its signing; or
• the existence of a written commitment containing provisions ensuring adequate protection and permission from the Board for the transfer.

Article 9(6) of the Law allows data controllers and data processors to transfer personal data abroad on an ad hoc basis under specific conditions.

Penalties

Furthermore, Article 18(1) of the Law introduces penalties for non-compliance with the notification obligation in Article 9(5) of the Law, with fines ranging from TRY 50,000 to 1,000,000 (approx $1,560 to $31,210).

Effective date of changes

The changes to the Law will come into force on June 1, 2024. However, the current first paragraph of Article 9 of the Law, which regulates the procedures and principles regarding the transfer of personal data abroad, will continue to be implemented until September 1, 2024, together with the amended version of the Article.

You can read the press release here and the Amending Law here, both only available in Turkish.