Standard Contractual Clauses

Standard contractual clauses are one of the appropriate safeguards that may be used for transferring personal data abroad under the KVKK. They are prepared and published by the Personal Data Protection Board and are the most commonly used mechanism for cross-border data transfers.

Four Types of Clauses

The Board has set four different sets of standard contractual clauses depending on the roles of the parties:

• Transfer from controller to controller,
• Transfer from controller to processor,
• Transfer from processor to processor,
• Transfer from processor to controller.

The parties must first identify their roles correctly, based on the distinction between data controller and data processor. Choosing the wrong type makes the basis for the transfer questionable.

No Changes Allowed, Annexes Must Be Completed

The standard contractual clauses must be signed exactly as published by the Board; their provisions cannot be amended. Information specific to the parties goes in the annexes: categories of data transferred, groups of data subjects, purpose and frequency of the transfer, retention period, and the technical and organisational measures taken. Annexes filled in with generic wording defeat the purpose of the clauses.

Notification Within Five Business Days

Once signed by persons authorised to represent the parties, the clauses must be notified to the Personal Data Protection Authority within five business days of signature, together with documents evidencing signing authority. A party that fails to notify is subject to a separate administrative fine.

When Are They Required?

Standard contractual clauses are required when one of the parties is abroad; they are not signed between two companies established in Turkey. A commercial relationship or invoicing between the parties is not required; an actual transfer of data is enough. For example:

• An e-commerce company sharing recipient details of orders shipped to Europe with a logistics company in Germany,
• A hospital backing up patient data with a cloud provider in Ireland,
• A manufacturer transferring employee data to an HR software provider in Singapore.