GDPR transfers from Germany to engineers in Türkiye
Türkiye has no EU adequacy decision: it was not on the European Commission's list as of 2 October 2026. EDPB Guidelines 05/2021 (version 2.0) treat remote access from a third country as a transfer when the three transfer criteria are met, even if personal data is only displayed for support or troubleshooting. Production access for our engineers can therefore need a Chapter V transfer tool, such as the Standard Contractual Clauses of Implementing Decision (EU) 2021/914, with the module matched to each party's role. Clause 14 adds a warranty from both parties that they have no reason to believe the laws and practices in the destination country prevent the importer from complying. According to the BfDI, private companies in Germany are mostly supervised by the data protection authorities of the federal states (Länder). The Digital Omnibus proposal to amend the GDPR was still at the 'Tabled' stage on 20 September 2026, so the current text applies. A lawyer should check which module fits and what goes in the annexes.





