Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad Has Been Published!

The draft "Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad" (the "Draft Regulation"), published by the Personal Data Protection Authority (the "Authority") on 09.05.2024, had been opened for public consultation.

The "Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad" (the "Regulation") was published in the Official Gazette No. 32598 dated 10 July 2024.

Two points stand out as differing from the Draft Regulation.

• The Draft Regulation provided for an obligation to notify the Authority within five business days following execution of the standard contract. The Regulation preserves that notification obligation and introduces a further one through paragraph 8 added to Article 14. Accordingly, where there is a change in the parties to the standard contract, or in the information and statements included in its content by the parties, or where the standard contract is terminated, the Authority must be notified. Notification may be made physically, through a registered electronic mail (KEP) address, or by other methods determined by the Board.

• The transitional provision set out under the "Miscellaneous and Final Provisions" heading, concerning the period during which the pre-amendment rules would remain in force, has been removed.

Apart from the amendments noted above, the Regulation as published is parallel to the Draft Regulation that was opened for consultation. The full text of the Regulation is available at this link.