GDPR transfers when engineers in Türkiye work on Austrian systems
The national act supplementing the GDPR is the Datenschutzgesetz (DSG), as amended, and the supervisory authority is the Österreichische Datenschutzbehörde (DSB). As of 2 October 2026, Türkiye is not on the European Commission's list of adequacy decisions, so access from Ankara needs another Chapter V transfer tool, such as the Standard Contractual Clauses in Implementing Decision (EU) 2021/914. They count as appropriate safeguards under Article 46 and come in four modules: controller to controller, controller to processor, processor to processor and processor to controller. Under Clause 14, both parties warrant that they have no reason to believe the destination country's laws and practices prevent the importer from complying. To reduce what is transferred, keep personal data out of development: seeded test data in staging, production access only where a task needs it. Your lawyer should confirm the module and annexes before onboarding.





