Personal Data Protection Board’s Announcement On Binding Corporate Rules
Turkish Personal Data Protection Board (“Board“) issued an important announcement on 10.04.2020 that closely concerns those of Turkish data controllers who transfers personal data abroad.
In the current practice, if data controller should provide the processing conditions in article 5 paragraph 2 and requirements in article 6 paragraph 3 of Turkish Data Protection Law, it is possible to transfer data abroad with data protection agreement.
With mentioned announcement Board announced the Binding Corporate Rules as an alternative method for data protection agreement for data transfer abroad.
Corporate Binding Rules are the personal data protection rules that have to be complied with by the data controllers in Turkey when they engage in transfer of personal data to their group companies located in foreign countries that were classified as countries do not have sufficient protection.
However, it should be noted that the Binding Corporate Rules for data controllers are used to transfer personal data from data controllers based in Turkey to other data controllers or data processors within the same group and outside Turkey. Therefore, the obligations set out in the Binding Corporate Rules for data controllers those acting as data controllers in the same group and those who act as “internal” data processors.
Binding Corporate Rules form is obtainable from Board’s website and for the application, if the Group is headquartered in Turkey, then the headquarter is authorized to lodge an application. If the group does not have a headquarter in Turkey, then member of the Group located in Turkey should be granted authorized for the matters of protection of personal data.
When making an application (a) Binding Corporate Rules application form (b) Binding Corporate Rules text and (c) all information and documents deemed necessary for the application by the applicant should be submitted. Apart from these, the Authority may request for further information and document if it deems necessary.
All applications shall be concluded by an evaluation done in one (1) year starting from the official application and all applications will be submitted to the Authority headquartered in Ankara/Istanbul by physically or mail. If the application approved, this situation will be notified to the relevant person.
In conclusion, with the announcement published by the Board, more detailed and comprehensive method was provided alternative to data protection agreement. By the method of Corporate Binding Rules, without making an agreement with the whole group company, transfer of personal data abroad was facilitated for group companies so long as they fill the Corporate Binding Rules Form and get the approval by the Board.
Should you require any further clarification, please do not hesitate to contact us.
Av. Mahmut Barlas
Published :
Categories: Data Protection