Personal Data Protection Authority Announced the First Decision Which Allows Data Transfer Abroad On February 9, 2021.

Personal Data Protection Authority Announced the First Decision Which Allows Data Transfer Abroad On February 9, 2021.


The Turkish Personal Data Protection Authority (“Authority”) has published a public announcement regarding the acceptance of the Commitment of TEB Arval Vehicle Fleet Leasing Corporation for the transfer of personal data abroad. On the announcement dated February 9, 2021, the Authority declared that they evaluated the Commitment within the scope of Article 9(2) of Personal Data Protection Law no. 6698 (“DP Law”) and granted the permission for the data transfer in question. This decision has been the first permission of the Authority for the data transfer overseas and set the standards for other Data Controllers.

According to the directives published on the Authority’s official webpage, Commitments regarding the data transfer abroad must include:

  • Data controller’s (or the authorized attorney’s) full name, signature and documents which proof the authority to sign (if the application is made by an attorney original or the approved copy of the Power of Attorney must be submitted.)
  • Documents proving the authority to sign of the documents on behalf of the data receiver (for the countries which are not part of “the Hague Apostille Convention” of October 5, 1961, legalization procedure must be undertaken.)
  • Signatures at the end of the Commitments and each addendum as well as the initials on all the pages
  • Notary approved translations of documents in foreign languages
  • Copy of the Commitment which is published on the official webpage of the Authority (if the parties add more articles it must be included under “Additional Provisions” title separately)
  • Clear explanations regarding the legal status of the Parties and documents which indicates the relation between the Parties, such as contracts
  • Basis for the data transfer, data subject group, transfer purpose and data categories
  • Clarification about the technical and executive precautions (in compliance with the Authority’s Technical and Executive Precautions Guide on the Security of the Personal Data)
  • Data storage period and the maximum legitimate period for the data proceeding

According to the guide of the Authority, while preparing addendums to the Commitment, exact terminology of the DP Law shall be used, and sentences shall be formed in future tense. The Guide also states that the data subject group must be clarified unambivalently and words such as “like, possible, potential, future, similar, like” must be included when data subject group is mentioned. 

Click for The official announcement of the Authority

© 2019 Deriş - All Rights Reserved