Turkiye: Data Protection Authority released guidelines on standard contracts concerning cross-border data transfers

On 5 February 2025, the Turkish Data Protection Authority (KVKK) published guidelines on standard contracts for the international transfer of personal data. The initiative concerns the validity of standard contracts used in the transfer of personal data abroad, as regulated by Article 9 of the Personal Data Protection Law No. 6698. The standard contracts must be signed by authorised representatives of both parties and, if they are in a foreign language, the signatures must also appear on the Turkish version. Contracts must be submitted to the authority within five working days and must be accompanied by supporting documents, including notarised Turkish translations and apostille certifications where applicable. Any changes to the text of the contract should be limited to optional or alternative clauses, as the standard contract templates are considered to provide adequate safeguards for international data transfers.