INFORMATION NOTE ON THE AMENDMENT OF CERTAIN ARTICLES OF THE LAW ON THE
PROTECTION OF PERSONAL DATA

I. INTRODUCTION
According to the 8th Judicial Package, the law amending the Law on Protection of Personal
Data No. 6698 was published in today’s Official Gazette.
The Law No. 32487 dated 12 March 2024, published in the Official Gazette, regulates
amendments to the Code of Criminal Procedure and Some Laws. Within the scope of Articles
33-36 of the relevant law, changes to Law No. 6698 on Protection of Personal Data (“PPDL”)
are envisaged.
The amendments under the PPDL will come into force on 1 June 2024.

II. CHANGES REGARDING THE TRANSFER OF PERSONAL DATA ABROAD
The approach that explicit consent is the main option for the transfer of personal data abroad
has been removed by the proposed amendments, transforming explicit consent into a
possibility that can be used for temporary or momentary transfers of personal data.
Qualification decisions by the Board may be issued not only for countries but also for sectors
within the country or international organizations. A fundamental change regarding the main
options for transferring personal data is the removal of the requirement for Board approval for
standard contracts to be signed. Additionally, exceptional cases for the temporary or
momentary transfer of personal data have also been proposed within the changes.
The proposed changes are considered to significantly address the issues encountered in the
practice of transferring personal data abroad and eliminate the obligation to rely on explicit
consent.

III. AMENDMENTS REGARDING THE PROCESSING OF SPECIAL CATEGORIES OF PERSONAL
DATA
With the proposed amendment, an expansion is suggested in the processing conditions of
special categories of personal data, including the addition of new processing conditions to
the PPDL such as being expressly provided by laws, being impossible in practice, being made
public by the data subject, being mandatory for the establishment, exercise, or protection of
a right, fulfilling obligations such as employment, occupational health and safety, and
establishing relationships with members of non-profit organizations such as associations and
foundations.
It is evaluated that the mentioned amendment will significantly reduce the situations where
explicit consent is required for the processing of special categories of personal data, especially
in the context of employee recruitment processes.

IV. AMENDMENTS REGARDING SANCTIONS ON PERSONAL DATA
According to the proposed amendment to the PPDL, administrative fines ranging from
50.000,00 TL to 1.000.000,00 TL are envisaged if the standard contracts to be signed for the
transfer of personal data abroad are not reported to the Authority within five business days
from the date of signature. As there will be no increase in these amounts in line with the
revaluation rate, the amounts are considered relatively low compared to other fines.
The proposed changes include data processors as well as data controllers as the subjects of
administrative fines. Additionally, administrative courts, rather than criminal peace judgeships,
are designated as the appeal authorities against administrative fines.