The Law No. 7499 on Amendments to the Code of Criminal Procedure and Certain Laws” published in the Official Gazette dated 12 March 2024 introduced major amendments to certain articles of the Law No. 6698 on the Protection of Personal Data (“KVKK“).

Accordingly, three important amendments have been made to the KVKK;

1) The conditions for processing special categories of personal data regulated under Article 6 of the KVKK have been expanded. From now on, the processing of special categories of personal data is possible if one of the following conditions is fulfilled

1. Explicit consent of the relevant person,

2. It is clearly provided in the laws,

3. It is necessary for the protection of the life or bodily integrity of the person who is unable to disclose his/her consent due to actual impossibility or whose consent is not deemed legally valid, himself/herself or of another person,

4. It is related to the relevant person’s personal data made public and in accordance with his/her will to make it public,

5. It is mandatory for the establishment, utilisation or protection of a right,

6. It is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning, management and financing of health services by persons under the obligation to keep secrets or authorised institutions and organisations,

7. It is mandatory for the fulfilment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance,

8. For current or former members and members of foundations, associations and other non-profit organisations or formations established for political, philosophical, religious or trade union purposes, or for persons who are in regular contact with these organisations and formations, provided that they comply with the legislation to which they are subject and their purposes, are limited to their fields of activity and are not disclosed to third parties.

2) Article 9 of the KVKK regulating the transfer of data abroad has also been amended.  Data transfer abroad, which is subject to the explicit consent of the relevant person and/or the approval of the Personal Data Protection Board (“Board”), has been facilitated.

a)Personal data may be transferred abroad by data controllers and data processors if one of the conditions for processing personal or special categories of personal data specified in Articles 5 and 6 of the KVKK exists and there is an adequacy decision about the country, sectors within the country or international organisations to which the transfer will be made. It is regulated how the adequacy decision will be taken and which issues will be taken into consideration.

b) In the absence of an adequacy decision, personal data may be transferred abroad by data controllers and data processors if one of the safeguards specified in the article is provided by the parties, provided that one of the conditions for processing personal or special categories of personal data specified in Articles 5 and 6 of the KVKK exists, the relevant person has the opportunity to exercise his rights and to apply for effective legal remedies in the country where the transfer will be made.

As a matter of fact, the most important of these safeguards is the existence of a standard contract to be concluded between the data transferor and the data recipient, which is announced by the Board, which contains matters such as data categories, purposes of data transfer, recipients and recipient groups, technical and administrative measures to be taken by the data recipient, additional measures taken for special categories of personal data.

However, the obligation to notify the Board within five business days following the signing of this agreement has been introduced. An administrative fine of 50.000 Turkish Liras to 1.000.000.000 Turkish Liras is stipulated for those who fail to fulfil the notification obligation.

c) Data controllers and data processors may transfer personal data abroad only in the presence of one of the cases listed in the following article, provided that it is incidental, in the absence of an adequacy decision and if any of the prescribed appropriate safeguards cannot be provided.

d) It is stated that the procedures and principles regarding the implementation of the article on the transfer of personal data abroad will be regulated by regulation.

3) Lawsuit can be filed before administrative courts to appeal against the decisions of the Personal Data Protection Board as to administrative fines.

The aforementioned amendments shall enter into force as of June 01, 2024.

With that said, the former version of the first paragraph of Article 9 of the KVKK, which regulates the transfer of personal data abroad, will continue to be in effect until September 01, 2024 together with its amended version. In this respect, explicit written consents obtained for transfer of personal data abroad according to the former version of the first paragraph of Article 9 shall continue to be valid until September 1, 2024.