In accordance with Personal Data Protection Law No. 6698 and the Regulation on Data Controllers' Registry ("Regulation"), data controllers shall get registered to the Data Controllers' Registry ("VERBIS"). Deadlines for the registration obligation is announced by the Personal Data Protection Board ("Board"). Although the previous deadlines designated by the Board expired, in accordance with the Board's decision dated 01.03.2021 and numbered 2021/238, a new deadline is set for all data controllers subject to the registration obligation and this new deadline is fast approaching.

In light of the Board's decision, the following data controllers shall complete their registration until 31.12.2021 as to cover all of their data processing processes:

  • All real persons or legal entities processing personal data of any Turkish resident as data controllers located outside Turkey irrespective of their number of employees and balance sheet value,
  • Turkish resident real person and legal entity data controllers having more than 50 employees or an annual balance sheet with a value more than TRY 25 million (approximately 2.5 million EUR),
  • Real person and legal entity data controllers whose main field of activity is processing of sensitive personal data although they have less than 50 employees and an annual balance less than TRY 25 million,
  • Public authorities and institutions and public professional organizations.

In order to complete the registration, the data controllers shall take the following steps in brief:

  • A clear, updated, and accurate data processing inventory shall be prepared as to include information related to the purpose of data processing, data category, the data recipients, and the maximum time period required for the purpose of processing, data to be transferred abroad and measures to be taken for data security.
  • Data controllers located outside Turkey shall appoint a local data controller representative in Turkey. You may contact us any time for more information about our services to provide local representation for our clients with respect to the registration obligation.
  • Data controllers located in Turkey and data controller representatives shall determine a real person responsible for contacting and liaising with the Board in order to complete their registration purposes. The contact person shall be a Turkish citizen resident in Turkey as well. A contact person appointed for one data controller located in Turkey cannot be determined as a contact person for other Turkish resident data controllers. This restriction is not applicable for data controllers located outside Turkey.

In case that a data controller subject to VERBIS registration obligation fails to comply with this obligation, an administrative fine between TRY 39,334 (approximately EUR 3.9 thousand) and 1.966.857 (approximately EUR 1,97 million) may be imposed against the relevant data controller.

In addition to the above, we also suggest all data controllers which completed their registration by the previous deadline set by the Board to revisit their data processing inventories and checking whether their registration records in VERBIS are still updated.

If you have any questions and need our any assistance, you may contact us any time.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.