Transfer of personal data abroad is regulated in Article 9 of the Personal Data Protection Law No.6698 (Law No.6698). Pursuant to this article, in the event that adequate protection is not provided in the country to which personal data to be transferred, such data may be transferred abroad without explicit consent of the data subject upon the existence of commitment for adequate protection in writing by the data controllers in Turkey and authorization of the Personal Data Protection Board (Board).
As known, the Board announced one of the methods that enable the relevant parties to commit the adequate level of protection in writing as "Commitments" in terms of data transfer to be made by the data controllers established in Turkey to the data controllers established in countries where the adequate protection is not provided and the Board also determined the minimum criteria that must be included in the Commitments to be prepared by the parties and submitted to the Board for approval. In this context, data transfer will be possible after the commitments are approved by the Board.
However, these commitments generally facilitate the bilateral transfers to be made between the companies, but they may fall behind in providing a practical implementation in respect to the data transfers to be made between the multinational corporation communities. For this reason, the Board has determined "Binding Corporate Rules" as another method to be used in the cross-border data transfers to be made between these corporate companies.
Binding Corporate Rules are data protection rules used in the transfer of personal data for the multinational group corporation operating in countries where adequate protection is not provided and that enable the commitment of adequate protection in writing. Corporations that fall under this scope need to make an application for Binding Corporate Rules to the Authority, filling out the relevant form and following the instructions required.
Pursuant to subparagraph (b) of Article 9(2) of Law No.6698, such applications are subject to the approval of the Board.
**The English versions of the Forms below will be added shortly
Binding Corporate Rules Application Form for Data Controllers