GDPR transfers when engineers in Türkiye work on Hungary's data
Hungary supplements the GDPR with Act CXII of 2011 on the right to informational self-determination and on the freedom of information, and its supervisory authority is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), which runs a dedicated online portal for controllers to notify personal data breaches. As of 2 October 2026, Türkiye is not on the European Commission's adequacy list. EDPB Guidelines 05/2021 treat remote access from a third country as a transfer when the three transfer criteria are met, even if data is only displayed on a screen for support. That calls for another Chapter V tool, such as the Standard Contractual Clauses in Implementing Decision (EU) 2021/914; if you are the controller and the studio acts as your processor, that is the controller to processor module. Under Clause 14 both parties warrant they have no reason to believe the destination country's laws and practices prevent the importer from complying. It is worth confirming the module and annexes with your lawyer.





