It is well known that one of the most commonly used methods by data controllers and data processors for the transfer of personal data abroad is the signing of standard contracts which includes such as data categories, purposes of data transfer, recipient and recipient groups, technical and organizational measures to be implemented by the data importer, additional measures, and additional measures for sensitive personal data.

Depending on the nature and specifics of the data transfer and details, the standard contract types which were published by the Data Protection Board (the “Board”) on its website shall be adopted and used by data controllers and data processors.

According to Article 14/5 of the Regulation on the Procedures and Principles For the Transfer of Personal Data Abroad (in Turkish, “Kişisel Verilerin Yurt Dışına Aktarılmasına İlişkin Usul ve Esaslar Hakkında Yönetmelik”, hereinafter referred to as the “Regulation”), the standard contract, following the execution of the signatures, shall be notified to the Personal Data Protection Authority (the “DPA”) within 5 (five) business days, either physically, or through a registered electronic mail (KEP) address, or via other methods specified by the Board.

The Board already launched “Standard Contract Notification Module” (in Turkish, “Standard Sözleşme Bildirim Modülü”) in 2024 which is accessible at the link https://standartsozlesme.kvkk.gov.tr/ and also published a guide titled “Guideline On Notification of Standard Contracts To The Personal Data Protection Authority” (in Turkish, “Kişisel Verileri Koruma Kurumu Standart Sözleşme Bildirim Kılavuzu”) where the details of activating a user account and details in relation to submission of the standard contract is provided.

The parties to the transfer may specify in the standard contract which party will fulfill the notification obligation. If no such specification is made, the standard contract must be notified to the Authority by the data exporter. Accordingly, registration to the standard contract notification module and subsequent procedures must be carried out by the data controller or data processor determined to be responsible for the notification within the framework of this Regulation.

The Board seeks some requirements while signing and also submitting the standard contracts, some of which could be as below summarized:
–    The notification shall include documents certifying that the signatories are authorized, along with notarized translations of any foreign language documents.
–    In cases where the standard contracts are executed in a foreign language as well, both the data exporter and the data importer must have their signatures on the Turkish version of the contract. Even if the standard contract is drafted in a bilingual, two-column format with Turkish and another language, the signatures of both the data exporter and the data importer must appear in the column containing the Turkish text.

In cases of non-compliance with the standard contract notification obligation, an administrative fine ranging from a minimum of TRY 71,965 (approximately EUR 1,600) to a maximum of TRY 1,439,300 (approximately EUR 32,700) will be imposed for the year 2025.

Our Law Firm remains at your disposal for any further clarifications you may need.

Copyright © 2025 Cailliau&Colakel Attorney Partnership, All rights reserved.