| Reading Time: 5 Minutes

Personal Data Transfers to Third Parties in Turkey or Abroad

Table of Contents

The importance of data in 21^st-century business life is indisputable. Today, market actors that accelerate digital transformation activities inevitably process and incorporate all kinds of data they have the right to save to gain a competitive advantage in the free market.

Even though competition between market actors is always desirable and serves the consumer interest in the final analysis, when it comes to personal data, a need appears to strike a balance between market interests and the protection of personal rights and freedoms.

This balance is expressed in the basic principles and data protection conditions adopted in the legal regulations on protecting personal data, including the transfer of personal data. This article describes the transfer of personal data to third parties in Turkey or abroad; Law Number 6698 on the Protection of Personal Data (Kisisel Verilerin Korunmasi Kanunu, ‘KVKK’) examination will be carried out in the framework.

Transferring Personal Data as Personal Data Processing Activity

Processing of personal data is defined in Article 3 (three) of the KVKK, entitled Recognitions, as the acquisition, storage, modification, reorganization, disclosure transferring, taking over, making available, classifying or preventing its use of personal data in a completely or partially automated or non-automated manner if it is part of any data recording system.

Transferring personal data is also one of the types of data processing. However, the provisions regarding the transfer of personal data are regulated in KVKK separately from other types of data processing activities.

Personal Data Transfer to Third Parties in Turkey

The transfer of personal data to third parties in Turkey is regulated in Article 8 (eight) of the KVVK, entitled Transferring Personal Data. Personal data obtained for processing in the framework of the principles of the law by taking the express consent of the person concerned can be transferred to third parties in Turkey.

As mentioned, the transfer of personal data is within the scope of personal data processing activities. For that reason, KVKK is searching for the same conditions with processing data to be transferred to third parties in Turkey.

In this sense, the personal data shall be, provided in accordance with Article 5 -2 of the KVKK or in case of one of the conditions specified in Article 6 -3 of the KVKK, provided that adequate measures are taken, transferred to third parties without seeking the consent of the person concerned in Turkey. The Personal Data Protection Board determines the adequate measures for private personal data transferred to third parties in Turkey.

Within the framework of the above description, the transfer of personal data to third parties in Turkey must have one of the following cases:

Obtaining the express consent of the person concerned,
Explicitly stipulated in the law,
It is compulsory for the protection of the life or body integrity of the person or someone else who is unable to disclose his consent due to the impossibility or whose consent is not granted legal validity,
The processing of personal data of the parties to the contract is required, provided that it is directly related to the establishment or performance of a contract,
The data officer must fulfil their legal obligation,
Having been publicized by the person concerned,
Data processing is mandatory for the establishment, use or protection of a right,
Providing that data is compulsory for the legitimate interests of the data officer, provided that they do not harm the fundamental rights and freedoms of the person concerned.

In addition, to transfer private personal data in Turkey, one of the following cases must be present.

In case the explicit consent of the person concerned is obtained,
If it is explicitly provided for by law in terms of personal data other than health and sexual life,
In terms of personal data related to health and sexual life, the persons or authorized institutions and organizations are obligated to keep secrets to protect public health, perform preventive medicine, medical diagnosis, treatment and care services, plan, manage and finance health services.

Transferring Personal Data Abroad

The transfer of personal data abroad is regulated in Article 9 (nine) of the KVVK, entitled Transfer of Personal Data Abroad. In KVKK, the transfer of personal data abroad is prohibited as a rule if the person concerned does not have explicit consent.

However, in addition to the exceptions outlined in Articles 5 and 6 of the KVKK, which allow the transfer of personal data without the express consent of the person concerned, it is compulsory to make assessments on the data protection regulations of the country in which the personal data will be transferred;

In this sense, the data shall be transferred to foreign countries if a) there is adequate protection, b) in the absence of adequate protection, adequate protection of responsible data officers from Turkey and in the relevant foreign country to commit themselves in writing and permission from the Board of Protection of Personal Data is obligatory. Countries with adequate protection shall be announced separately by the Board.

Within the framework of our explanations above, personal data transfer abroad according to Article 9 (nine) of KVKK;

Having the express consent of the person concerned.
Existence of the conditions specified in the law (conditions specified in Article 5 and Article 6 of KVKK) when transferring data to countries with adequate protection (those considered safe by the Board).
Data transfer to countries with insufficient protection in the presence of the conditions specified in the Law (Article 5, paragraph 2, Article 6, paragraph 3 of KVKK) can be realized in case of a written commitment of adequate protection and permission of the Board.

The law seeks the same conditions for the processing of data and the transfer of such data abroad. In addition, it is envisaged that additional measures will be taken for the transfer of data abroad.

If the person has express consent, it is possible to transfer data abroad. In cases other than express consent, the law introduces different provisions for the transfer of personal data abroad, depending on whether there is enough protection in the country of transfer;

A. In Case of Adequate Protection

Personal data explicitly stipulated in the law,
It is compulsory for the protection of the life or body integrity of the person or someone else who is unable to disclose his consent due to the impossibility or whose consent is not granted legal validity,
The processing of personal data of the parties to the contract is required if it is directly related to the establishment or performance of a contract,
The data officer must fulfil their legal obligation,
Having been publicized by the person concerned,
Data processing is mandatory for the establishment, use or protection of a right,
Providing that data is compulsory for the legitimate interests of the data officer if they do not harm the fundamental rights and freedoms of the person concerned can be transferred abroad.

B. Private Personal Data

Personal data other than health and sexual life shall be transferred abroad if expressly stipulated by law and if there is adequate protection in the country in which the personal data will be transferred.
In countries with adequate protection, personal data on health and sexual life of persons, for the purpose of the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of health services can be transferred abroad by organizations, without seeking the express consent of the person concerned by authorized institutions with a confidentiality obligation.
The Board shall announce countries with adequate protection.

C. For Data Transfer to Countries That Are Not Adequately Protected

The fulfilment of at least one of the conditions listed in Article 5 or Article 6 of the Law,
Adequate protection of responsible data officers in Turkey and foreign countries to commit themselves in writing,
Permission from the Board is required.

Related Articles:

Economic Crimes in Turkish Criminal Law

We invite you to read our article titled "Economic Crimes in Turkish Criminal Law" written by MGC Legal team; here are the details... Introduction: Economic Crimes in Turkey The economy, which is de..

Restructuring and Insolvency Law: Questions and Answers

What domestic legislation governs restructuring and insolvency matters in your jurisdiction? The Enforcement and Bankruptcy Code regulates concordat, restructuring and bankruptcy proceedings. The B..

Judicial Separation

What is Judicial Separation? A judicial separation is a legally recognized split approved by the court. It's more than simply a couple agreeing to live apart, and it's more than just legitimizing t..