As of today, 1 June 2024, substantial revisions to Turkey’s Personal Data Protection Law (Law No. 6698) have come into effect. These amendments, initially published on 12 March 2024 in the Official Gazette under the number 32487, align closely with the standards set by the EU’s General Data Protection Regulation (GDPR). CCS Law is pleased to provide a brief analysis of these pivotal legislative updates, highlighting the advancements in the protection of personal data and cross-border data transfer.
Key Changes and Their Impact
Special Categories of Personal Data
The amendments provide clearer and more comprehensive guidelines for processing special categories of personal data. Under the revised Article 6 of Law No. 6698, conditions for processing sensitive data, such as health and sexual life information, have been expanded to include several legal bases beyond the individual's explicit consent. These include:
Legal necessity for the protection of someone's life or physical integrity,
Compliance with legal obligations for employment, social security, and social protection law,
Purposes related to preventive medicine, medical diagnosis, and healthcare.
These changes aim to balance the need for sensitive data processing with robust protections, ensuring data handling complies with strict legal and ethical standards.
Cross-Border Data Transfers Turkey’s Personal Data Protection Law
One of the most critical updates in Law No. 6698 involves the conditions for transferring personal data outside Turkey. Amendments to Article 9 have introduced new mechanisms that align with GDPR standards, focusing on adequate protection measures and legal frameworks that facilitate safer international data transfers. Key provisions now include:
Transfers based on adequacy decisions by the Data Protection Authority,
Binding corporate rules,
Standard contractual clauses that must be notified to the Authority within five business days of agreement.
These mechanisms are designed to enhance the security and compliance of data transferred across borders, offering clarity and consistency for international operations.
Employer-Employee Data Handling
The amendments address specific challenges in the employer-employee context, particularly around health data processing. Conditions under which employers can process health data have been clarified, aiming to prevent misuse and ensure that such handling is strictly necessary and legally justified.
Regulatory and Compliance Adjustments
Organisations must adapt to these changes swiftly, with a grace period extending to 1 September 2024 to align existing practices with the new regulations. This includes revisiting data processing activities that previously relied on explicit consent and adjusting them to comply with the broader legal grounds now permitted under the amended law.
What This Means for Your Business
The revisions to Turkey’s Personal Data Protection Law represent a significant shift towards stronger data protection practices. Businesses operating within and interacting with Turkish jurisdictions must review and potentially overhaul their data protection and handling protocols to ensure compliance. This involves:
Conducting thorough data protection impact assessments,
Revisiting data processing agreements,
Ensuring all data transfers meet the new legal requirements, particularly for international transfers.
With these amendments, Turkey takes a significant step towards international data protection standards, enhancing both the security and the legal framework for personal data handling. These changes are not just regulatory; they are strategic, facilitating safer and more compliant data practices that can boost trust and cooperation across borders.
CCS Law remains dedicated to guiding our clients through these changes, ensuring that they not only understand the legal landscape but are also well-prepared to meet their compliance obligations effectively. For more detailed guidance or specific inquiries, please contact our expert legal team.
Comments