Cross-border transfers of personal data: working with standard contractual clauses
A practice note on running the transfer mechanisms introduced by the 2024 amendment within a company.
Article 9 of the Personal Data Protection Law No. 6698 was amended by Law No. 7499, and the new regime entered into force on 1 June 2024. Cross-border transfers now follow a tiered structure: adequacy decisions, appropriate safeguards and occasional transfers.
When do standard contracts come into play?
Where no adequacy decision exists for the destination country, the standard contracts published by the Board may be used as one of the appropriate safeguards. The contract must be used without amendment and notified to the Board within five business days of signature.
Running it in practice
The most common problem in practice is losing track of which transfer relies on which mechanism. We recommend a separate transfer inventory for cloud services, intra-group reporting and support services, each line showing the counterparty’s role (controller or processor) and the mechanism relied on.
Given the short notification period, it helps to add a checkpoint to contract signing: when procurement submits a contract involving personal data transfers for signature, the legal team should be notified automatically.
This note is for general information; specific transfer structures require separate assessment.
This content is for general information and is not a substitute for legal advice.