With the 8th Judicial Package, which was carried out within the scope of compliance with GDPR on 12 March 2024 and will come into force on 1 June 2024, articles 6 and 9 of the Personal Data Protection Law were amended. Draft Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, which determines the procedures and principles of data transfer abroad in Article 9 of the Personal Data Protection Law. It was published and presented to the public in May 2024.

The draft regulation states that personal data can only be transferred abroad in accordance with the procedures and principles set out in the Personal Data Protection Law and this regulation. In this context, the existence of one of the conditions in Articles 5 and 6 of the Personal Data Protection Law and

• There is an adequacy decision regarding the country to which the transfer will be made, the sectors in the country and international organizations,
• In case there is no adequacy decision, providing one of the assurances included in the appropriate assurance methods in Article 10 of the draft regulation,
• Existence of one of the exceptional circumstances in cases where the adequacy decision and assurances cannot be provided

When one of the conditions is met, personal data may be transferred abroad by data controllers and data processors. It is seen that the adequacy decision, appropriate assurance methods and exceptional transfer cases are detailed in the draft regulation, however, board decision or approval is required for many cases.

The draft regulation will be kept open to public comment until May 20, 2024, and no comments will be received after this date. To get more information about the Public Announcement on the Draft Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad and to access the draft regulation and opinion form you can click here.