Automated Decision-Making (ADM) covers decisions about individuals made solely by automated means — including profiling — without meaningful human involvement (GDPR Article 22).

The EU-US Data Privacy Framework (DPF) is the European Commission’s July 2023 adequacy decision (and the parallel UK Extension and Swiss-US Framework) that permits transfers of personal data from the EU/EEA to certified US organisations without additional SCCs or TIAs for those specific transfers.

A TIA documents whether the destination country’s laws let your data importer honour SCC safeguards — the Schrems II legacy, now echoed in KVKK’s 2024 regime. The five sections of a defensible assessment.

Turkish employment contracts and offer letters commonly express compensation as either brüt (gross) or net salary.

Mobbing (işyerinde psikolojik taciz) refers to systematic, persistent, and hostile treatment of an employee at the workplace, intended to humiliate, marginalise or force resignation.

Under Turkish Labour Law (4857 Sayılı İş Kanunu) Article 2(6)-(7), an alt işveren (subcontractor employer) is an employer that undertakes a specific portion of the principal employer’s (asıl işveren) production or service operations, in connection with auxiliary tasks or specialised areas requiri…

Binding Corporate Rules (BCRs) are internal data protection rules adopted by multinational groups to legitimise intra-group transfers of personal data from the EU/EEA to third-country group entities (GDPR Article 47).

Standard Contractual Clauses (SCCs) are pre-approved EU contractual templates that legitimise transfers of personal data from the EU/EEA to “third countries” lacking an adequacy decision (GDPR Article 46(2)(c)).

A sub-processor is a third party engaged by a processor to perform some or all of the processing on behalf of the controller (GDPR Article 28).

Two or more controllers are joint controllers when they jointly determine the purposes and means of processing of personal data (GDPR Article 26).