Communication and processing are basic processes in the journey of data to information, and information to service. Data storage and data protection measurements regarding these two processes are the most important requirements of our day. For this purpose, while recently GDPR entered into force in Europe, KVKK has entered into force in Türkiye.

Can data be transferred abroad?

It was decreed that the personal data obtained to be processed within the frame of general principles defined under KVK (Protection of Personal Data) Law can only be transferred online with the express consent of the relevant person. The law requires the same terms for the processing of personal data and transferring this data abroad. Also, additional measurements in the transfer of personal data abroad were stipulated.

Transfer of personal data abroad was defined under KVK Law, 9th article, (1st) paragraph as “Personal data cannot be transferred abroad without the express consent of the relevant person”.

Also, the transfer of data abroad can only be possible if:

• The circumstances stipulated in the law are present (conditions stated in the 2nd Paragraph of the 5th Article and 3rd Paragraph of the 6th Article of the Law), necessary protection exists in the data receiver country (Countries accepted by the board)
• Sufficient protection is guaranteed in writing and the Board provides permission, in the event that there is not sufficient protection in the data receiver country (countries that are not considered safe by the Board) despite the circumstances stipulated in the law are present (conditions stated in the 2nd Paragraph of the 5th Article and 3rd Paragraph of the 6th Article of the Law)

If you like we can give an example on this topic: Your customers may ask where their data is being stored and processed, and they might not show consent if this processing is done abroad. There is a chance of having a complaint against you in the case that you do not receive the individual consent of your customers. In this case, you may have to delete all data belonging to this person or transfer those to a separate platform in the country. In terms of the cloud software you use (CRM, ERP, etc…), it may not be technically possible to separate this data and move it to a structure hosted only within the country. For this reason, using products and platforms that make it possible for the data to be stored and processed in the country will ensure your compliance with the relevant laws and legislations.

In summary; we can say that using one of the local software where you can find a substitute locally and not having any data leave the country is the safest way.

President Erdoğan, in his speech at the opening ceremony of The Information and Communication Technologies Authority Computer Emergency Response Team of the Republic of Turkey, pointed towards the importance of data security and said “Today, data has become as much as important as oil. Trying to ensure data security with foreign solutions is equal to entrusting the borderline security to foreign soldiers. Based on this fact we are expediting the domestic and national solution works regarding data security…”

Türkiye’s Ministry of Transport and Infrastructure’s statements on this issue are also important. They have made many press releases on this issue and shared a set of rules to abide by. Deputy Ministry of Transport and Infrastructure Ömer Fatih Sayan stated that “We are making plans to secure our data and not have them leave our country. We are taking firm and confident steps to support domestic and national production. For this, it is very important that we produce our own technology.”

“Data processor” is defined as natural or legal persons outside your organization who process personal data on your behalf based on authorization you have provided. You should ask where the organizations that you entrust your data (Data Processor) store your data, and how they process it and also receive necessary guarantees.

If the products and platforms that you use are not domestic and do not provide services within the borders of Türkiye you cannot be sure if data is transferred to foreign cloud environments or transferred abroad.
Have a safe day.