Information Technology LawHow is the Transfer of Personal Data Abroad Regulated?

Transfer of Personal Data Abroad: Legal Aspects

The transfer of personal data abroad is an important issue within the framework of data protection legislation. In this article, I will discuss the legal dimension of the transfer of personal data abroad.

Personal Data Protection Law (KVKK) and Transfer of Personal Data Abroad

The Law on the Protection of Personal Data (KVKK) regulates the processing, protection and transfer of personal data abroad. Article 9 of the LPPD regulates the transfer of personal data abroad. According to this article, in order for personal data to be transferred abroad, one of the following conditions must exist

1. Explicit Consent of the Data Subject:
   • In order for personal data to be transferred abroad, the explicit consent of the data subject is required.
   • Explicit consent is the consent given by the data subject with his/her informed and free will.
2. Countries with Adequate Protection:
   • If personal data will be transferred to one of the countries with adequate protection, the processing conditions specified in paragraph 2 of Article 5 or paragraph 3 of Article 6 of the KVKK must be present, depending on the nature of the data to be transferred.
   • Adequate protection refers to countries that effectively protect the rights and data of the data subject.
3. Countries without Adequate Protection:
   • In the transfer of personal data to countries that do not provide adequate protection, the processing conditions specified in paragraph 2 of Article 5 or paragraph 3 of Article 6 of the KVKK must be present depending on the nature of the data to be transferred.
   • In this case, the data controllers in Turkey and in the relevant foreign country must undertake adequate protection in writing and the Personal Data Protection Board must have authorisation.

The transfer of personal data abroad is an issue that requires attention for data controllers and practitioners. It is important to transfer data in accordance with the conditions determined by the KVKK in terms of data security and protection of personal rights.