Turkish Data Privacy Law: Impact on Foreign Data Controllers

How do the latest Turkish Data Privacy Laws changes affect foreign data controllers collecting Turkish Data?

Dear non-Turkish collectors of personal data of Turkish data subjects,

We wanted to call out to you to remind you that although a very similar international data transfer regime to GDPR has been introduced in Turkey as of September 2024 (see our blog), if you are collecting data directly from Turkish citizens in your servers whether in Turkey or outside of Turkey, you could be a Foreign Data Controller and have serious liabilities with the Turkish Authority.

Remember our blogs on Foreign Data Controllers’ obligation to register with the Turkish Authority (the registry so-called VERBIS) and our KP Talks.

We have commenced experiencing the investigation phases regarding such obligations by the Turkish Authority.

It has become recently apparent to many foreign data collectors/controllers via official notices sent by the Turkish DPA with inquiries of how they collect and process data (i.e. many social media network providers) that not being legally existent in Turkey (i.e. having a rep office or subsidiary) does not relieve the foreign collector/controller of its legal obligations to abide by the Turkish Data Privacy Laws and especially their obligation to register themselves with the Turkish Authority.

Following the initial notice to the said foreign data collector/controller, the Turkish Authority seems to wait for some time to get the responses of the foreign entity, and after reviewing the responses (or witnessing that no response is provided at all) and doing independent research on the relevant website, etc. of the foreign entity, if it deems that the said foreign entity does not provide due privacy notices, cookie policies and especially is not registered with the VERBIS, sends administrative fines to the said foreign entities.

So be aware of the legal liabilities against the Turkish Authority under the relevant Turkish Data Privacy laws which are getting closer to GDPR and its applications every day. If you have any further questions regarding your data processing processes in Turkey, we would gladly assist you in every aspect of compliance with Turkish Data Privacy Laws.

Last but not least, you may follow our updates regarding the latest news on our privacy blog.