On August 18, 2018 four important decision by the Data Protection Authority of Turkey were published in the Official Gazette.
Pursuant to the decisions, i- Customs Brokers, ii- Mediators and iii- Data Controllers with 49 or less number employees with an annual financial balance sheet less than TRY 25.000.000+ (USD 4.150.000) and with a core business field that does not require processing of sensitive data are exempt from the requirement to register with the Data Controllers Registry.
Furthermore, the obligation to register with the Data Controller's Registry for data controllers with 50+ employees and annual financial balance sheet of TRY 25.000.000+ (USD 4.150.000) will commence on 01.10.2018 and all data controllers (except those that fall within the exemption) shall finalize registration by 30.09.2019.
Moreover, the Authority once again stated in their decision that data controllers that are located outside of Turkey shall also register between 01.10.2018 and 30.09.2019.
According to the said decisions, data controllers with a core business field that require processing of sensitive personal data but have 49 or less employees with an annual financial balance sheet less than TRY 25.000.000+ (USD 4.150.000) shall register with the Registry between 01.01.2019 - 31.03.2020.
Pursuant to the Data Protection Law w. no 6698 and the Regulation On Data Controller Registry (please visit www.dataprotectionturkey.com to review English versions of these legislative texts) the following information shall be provided for registration with the Registry;
- identity and address of the controller and of its representative, if any,
- purposes for which personal data will be processed,
- explanations about personal data categories and data subject categories,
- recipients or groups of recipients to whom the personal data may be transferred to,
- personal data which is planned/envisaged to be transferred out of Turkey,
- measures taken for the security of personal data.
- maximum period of time required for the purpose of the processing of personal data.
In light of the above, data controllers that collect data from Turkey (including controllers that are not located in Turkey) shall finalize necessary preparations, draft a data processing inventory and appoint a data controller representative using a Power of Attorney to comply with this requirement.
Please be informed that non-compliance with this requirement may lead to an administrative fee up to TRY 1.000.000 (USD 165.000).
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
