Turkish data protection law: GDPR alignment and key 2024 amendment

The Turkish Personal Data Protection Act (PDPA) came into force in 2016. Since then, expectations and discussions regarding the harmonisation of the PDPA with the General Data Protection Regulation (GDPR) have been on the agenda. The 2024 amendment to three articles of the PDPA can be seen as a first step towards this. In this regard, there is now a new regime for the transfer of personal data abroad in Türkiye. The amendment changed the scope of adequacy decisions, explicitly recognised binding corporate rules, and introduced standard contracts (standard contractual clauses [SCCs]) for the first time. This is a remarkable step towards alignment with the GDPR; however, significant differences remain, particularly in respect of data transfers based on the explicit consent of data subjects. According to the new provision of the PDPA, data transfers based on consent may only take place in incidental cases. There are a few other differences, including the absence of a docking clause in the standard contracts. More importantly, compliance with the GDPR cannot be achieved by amending only one or a few provisions. In assessing the new regime for transfers abroad, it is necessary to consider the provisions of the PDPA as a whole. This paper examines the revised data transfer regime in Türkiye in comparison to the GDPR and identifies the key issues related to this. This paper is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.