Amendments to Turkish Data Protection Law soon to enter into force

The Justice Reform Law, which amends important aspects of Turkish Data Protection Law No. 6698, was adopted by the Turkish Parliament on 2 March 2024 and published in the Official Gazette on 12 March 2024. The new provisions will enter into force as of 1 June 2024.

The amendments focus on cross-border data transfers and the processing of sensitive data. They were adopted without modification to the bill submitted to the Parliament on 16 February 2024.

For transfers of personal data outside Turkey, the current principle under which transfers primarily rely on explicit consent will continue to apply alongside the new rules until 1 September 2024. A separate regulation must be issued by the Turkish Data Protection Authority (DPA) in order to clarify the procedures and principles to implement the new framework on cross-border data transfers.

In a public announcement dated 12 March 2024, the DPA stressed that data controllers and data processors should use this transition period to make urgent preparations for complying with the new provisions. Companies should thus familiarise themselves with the new rules without delay and assess their own situation with regard to cross-border transfers in order to kick-start the compliance process when the law enters into force.

Please do not hesitate to contact us for any further information on this briefing.