Turkish SCCs and BCRs Now in Effect

On 10 July 2024, the Personal Data Protection Authority (KVKK) in Turkey published finalized documents on standard contracts and Binding Corporate Rules (BCRs). This release follows a period of public consultation on draft documents, aiming to ensure adequate safeguards for transferring personal data abroad under the revised Article 9 of the Law on Protection of Personal Data No. 6698.

KVKK’s initiative is part of its efforts to align data protection practices with international standards. The documents are designed to provide clear frameworks for entities involved in cross-border data transfers.

Standard Contracts for Data Transfers:

• • Controller to Controller
  • Controller to Processor.
  • Processor to Processor.
  • Processor to Controller

They are available in Turkish here, and will apply alongside the obligations under other laws, such as the GDPR. 

Practically, if you are an EU processor selling a service to a Turkish controller, you will need to have in place both the EU processor to controller SCCs (model 4) as well as the Turkish controller to processor SCCs. If you are an EU controller buying a service from a Turkish processor, you will need to have in place both the EU controller to processor SCCs (module 1), as well as the Turkish processor to controller SCCs. 

Note also that under the amended Turkish data protection law, the SCCs need to be notified to the KVKK within 5 business days after signature.

Binding Corporate Rules (BCRs):

• BCR Application Form for Data Controllers.
• Companion Guide for Controllers: Details essential issues that data controllers should include in their BCRs.
• BCR Application Form for Data Processors.
• Companion Guide for Processors: A guide outlining key issues for data processors to consider in their BCRs.

All documents are available here.