GDPR transfers when engineers in Türkiye work on Lithuanian systems
As of 2 October 2026, Türkiye is not on the European Commission's list of adequacy decisions, so EU personal data made available to a studio in Ankara needs another GDPR Chapter V transfer tool, such as the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914. Where your company is the controller and the studio your processor, the controller to processor module describes that relationship, and under Clause 14 both parties warrant that they have no reason to believe the laws and practices in Türkiye prevent the importer from complying. EDPB Guidelines 05/2021 explain why this matters for development work: their Example 11 concludes that a third-country processor remotely accessing EU-stored data for EU controllers results in transfers. Limiting production access reduces how much is transferred. It is worth confirming the set-up with your data protection lawyer.





