In Turkey, sensitive and non-sensitive personal data can be transferred to third parties if the explicit consent of the data subject is obtained, or if one of the additional legal grounds is applicable for the transfer. The Data Protection Law does not provide a definition for a third party; therefore, any individual or entity may be considered a third party. This creates a problem, especially in relation to transfers between data controllers and data processors. As a result, any transfer of personal data from a data controller to a data processor may be interpreted as a transfer to a third party.
