Standard Contract Notification Module is Available Now!

1. Introduction

The Law on the Protection of Personal Data No. 6698 ("Law") was amended. With Law No. 7499 on the Amendment of the Code of Criminal Procedure and Certain Laws ("Law Amendment") published in the Official Gazette on 12 March 2024, standard contracts were adopted as a new method for the transfer of personal data abroad.

The procedures and principles regarding the transfer of personal data abroad are determined by the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad ("Regulation") published by the Personal Data Protection Authority ("Authority") in the Official Gazette on 10 July 2024.

In the fifth paragraph of Article 14 of the Regulation, it is regulated that standard contract notifications may be made physically or by registered electronic mail (“KEP”) address or other methods determined by the Personal Data Protection Board ("Board").

In this context, the Board announced on 25 October 2024 the introduction of the "Standard Contract Notification Module" ("Module"), which was prepared to facilitate faster and more effective execution of standard contracts over the Internet.

With the launch of the Module, data controllers and data processors will be able to notify the Board of the standard contracts they have signed, either physically or via KEP address or by using the Module.

2. Using the Module

The guideline on the use of the Module ("Guideline") can be accessed via this link. The Guideline is only available in Turkish.

According to the Guidelines, firstly, an account must be created to use the Module on behalf of data processors or data controllers. Account creation is completed through the mobile phone and e-mail address used during account creation on the Module and no physical notification is required. It is also possible for data controllers or data processors residing abroad to create an account through the Module.

After creating an account, data controllers or data processors must fill in the relevant form on the Module and enter information such as residential address and tax identification number in the form. 

After the account creation is completed, the persons who are authorised to notify a standard contract on behalf of the data controller or data processor should be added by using the relevant forms on the Module to make a standard contract notification. Both Turkish citizens and foreign citizens can be authorised persons on the Module.

After the authorised person is registered through the Module, authorised persons will be able to make a standard contract notification through the Module on behalf of the relevant data controller or data processor.

Authorised persons who are Turkish citizens can complete the notification procedures by logging into the Module via the e-Devlet system.  Non-Turkish citizens can log in to the Module via the e-mail used during authorised person registration and the password sent to this e-mail address.

After the standard contracts are uploaded to the Module by the authorised persons, the process of sending them to the Authority via the Module must be done separately. After the standard contract is sent to the Authority via the Module, no changes can be made to the standard contract sent. However, it is possible to notify the subsequent changes made in the standard contracts through the Module.

Finally, if standard contracts are terminated between the parties in any way, termination notification must be made separately via the Module.

3. Things to Consider

•  The mobile phone and e-mail addresses used when creating the accounts of data controllers and data processors cannot be changed later. Therefore, it is important to use the correct e-mail and mobile phone addresses when registering for the first time. However, the use of personal e-mails and mobile phones of the persons working within the relevant company should be avoided and the contact information of the company should be used.
• After the account is created, the information of the data controller and data processors must be entered correctly on the relevant screen. This is because the place of residence and tax identification number or Turkish Republic identification number of the data controller or data processor cannot be changed afterward.
• When registering an authorised person, it is mandatory to upload the document stating that the authorised person is authorised to notify a standard contract via this Module on behalf of the data controller/data processor.
• While the duty or title information of authorised persons can be changed on the module, it is not possible to change the contact information. Since authorised persons who are not Turkish citizens will log in to the Module using the e-mail address used during the authorised person registration, this information must be correct.
• During the standard contract notification by authorised persons, the information of the standard contract’s parties must be added to the Module correctly. In parallel with the above explanations, it is not possible to change the information other than the address and website of the parties later.
• In the standard contract notification, the standard contract and other documents related to the standard contract (e.g. documents showing the authorised signatories and, if necessary, their notarised translations) must be uploaded separately to the Module.
• A separate approval process must be performed for sending the notifying contracts uploaded to the Module to the Authority. After the standard contracts are uploaded to the Module, the submission process to Authority the should not be forgotten. After the standard contracts are sent to the Institution via the Module, no edits can be made regarding the standard contracts. For this reason, it is important to fill in the standard contracts correctly and enter the correct information into the Module.

You can contact us at [email protected] for the correct notification of the standard agreements you have signed with the Institution and for the correct execution of the relevant transactions.