This new law deserves the focus of any firm that conducts business in Turkey or gathers the personal data of customers, workers, or other people found in Turkey although details remain somewhat short at this point.

Turkey’s new law is pretty much like the EU’s data protection regime in many regards, but in addition, it includes a couple of noteworthy differences.

Like the EU Data Directive, the Turkish Data Protection Law recognizes private info (meaning advice concerning an identified or identifiable individual) from sensitive (or specific) info, and makes sensitive info subject to additional protections. Nevertheless, Turkey’s law also categorizes info about a man’s look as sensitive info.
Both sensitive and private information may not be processed absent the information area’s express permission, but the law will not clarify what “express authorization” means.
Like the Directive, the law delegates specific duties so, and creates a differentiation between data controllers and data processors. Information controls must enroll with Turkey’s Data Protection Registry, that will be created by October 7 of this year.
The law imposes some limitations on the transport of personal information beyond Turkey; the receiving state must offer adequate data protection, and particularly, the data subject must give express permission for the transport. If the transferee state will not offer data protection that is adequate, Turkey’s Data Protection Board must grant permission for the transport. Nevertheless, firms still have time to ensure that their businesses are compliant with these conditions, as these cross border transfer rules WOn’t go into effect until October 7, 2016.
In a nutshell, the Data Protection Law seems to signify Turkey’s effort to harmonize its data protection regime with that now in force in the EU, which Turkey is striving to join. It remains to be seen the various provisions of the law will be interpreted, and how Turkey will apply the law, but in the meantime it is necessary for any business with Turkish ties to start familiarizing itself with that state’s new privacy regime.