Turkish Labor Law
Related Articles
The minimum particulars that must be included in the agreements between transferor (resident in Turkey) and receiver of personal data transferred between countries that have not adequate level of protection are issued in Personal Data Protection Board (The Board) website on 16 May 2018.
TRANSBORDER TRANSFER OF PERSONAL DATA
As per article 9 of Law No 6698 “Personal data cannot be transferred abroad without explicit consent of the data subject.”
Exceptions: The same exceptions specified in Art. 5 and Art. 6 (exceptions related to Processing Personal and Special Categories of Data which are explained below*) are valid for transfer of personal data, but following conditions should also be present;
- there is an adequate level of protection in the foreign country to which data is sent
- in case there is not adequate level of protection, data controllers in Turkey and in the concerned country should guarantee the adequate level of protection in writing, and also permission of the Data Protection Board is necessary.
Countries that have adequate level of protection will be determined and announced by the Board.
THE CASES NO EXPLICIT CONSENT IS NEEDED
*Personal data can be processed without seeking the explicit consent of the data subject in the presence of the following conditions:
- where it is clearly specified by laws
- where processing is necessary to protect the vital interests of the data subject or of another person where the data subject is physically or legally incapable of giving his consent
- where processing is necessary for drawing up or for performance of a contract to which the data subject is party
- where processing is necessary for fulfillment of legal obligation of the controller
- where the related data are made public by the data subject
- where processing is necessary for acquisition of, exercising of, or protection of a specific right
- where processing is necessary for legitimate interests of controller, on condition that fundamental rights and freedoms of the data subject are not violated.
- Personal data relating to health and sexual life may only be processed without obtaining the explicit consent of the data subject where processing of the data is required for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of health-care services, and where those data are processed by a health professional and authorized institution and organizations subject to the obligation of professional.
Conditions of cross- border personal data transfer shown in the table below.
| CONDITION/IN THE PRESENCE OF | CROSS-BORDER TRANSFER |
| Explicit consent | Yes |
| Exceptions (in art. 5 and 6) + Adequate level of protection | Yes |
| Exception + No adequate level of protection + Written undertaking between transferor and receiver in both country | yes |
THE MINIMUM PARTICULARS THAT MUST BE INCLUDED IN THE AGREEMENTS
- Data Controller To Processor
- Obligation of Data controller
- Obligation of Data Processor
- Common Provisions
- Data Controller To Controller
- Obligation of Data Transferor
- Obligation of Data Receiver
- Common Provisions
Full translation of above agreements will be published as an “Employer Bulletin” in our website.
