A very important step for compliance with the data protection law (Law on Protection of Personal Data w. no 6698 – "Law") is the Verbis Registration (Data Controllers' Registry) and the last day to register with Verbis is September 30, 2019.

Therefore, if your company is a data controller that collects and process personal data of individuals from the Republic of Turkey, please continue reading to avoid risks.

1- Is My Organization Required to Register?

Yes, if;

  1. your organization is a data controller located out of Turkey but collets and processes personal data or
  2. if your organization is a data controller located in Turkey with 50 or more employees and an annual turnover of more than try 25.000.000, or
  3. if your organization is data controller in Turkey with the core business of processing sensitive personal data (i.e.. Hospitals, doctors etc.) *(certain exemptions apply i.e. attorneys, notary publics etc. are not required to register regardless of the turnover and employee number)

Further, if your organization is a a data controller located abroad and your organization has a subsidiary in Turkey (which is another data controller), your organization will still need to register with the Verbis. Therefore, this would mean two registrations, one for your organization and one for the subsidiary in Turkey.

2- What Happens If My Organization Does Not Register?

The deadline is September 30, 2019. You can still register after the deadline but if you miss this deadline you may be subject to an administrative fine of up to TRY 1.470.000 given by the Data Protection Authority. Moreover, having been fined by the DPA may have reputational damage.

3- What Steps My Organization Should Take If I Believe My Organization Is Required to Register?

First step should be to prepare/update your personal data inventory. Your personal data inventory will be the basis and source for the entry to the Verbis.

If your organization is a data controller located out of Turkey, you must first duly appoint a Turkish Real Person or Legal Person as Data Controller Representative. Only after appointing a Data Controller Representative, the Data Controller Representative can start the entry on behalf of your organization.

After this, you must appoint a Turkish citizen as contact person on Verbis.

If your organization is a data controller located in Turkey, you can personally start and finalize the entry on behalf of your organization and it is not required to appoint a Data Controller Representative however you must appoint a Turkish citizen as a contact person on Verbis.

4- How Long Does It Take to Register?

Verbis uses a drop-down interface to enter data about the category of personal data, data subject, retention time, legal grounds for processing, purpose etc.

Therefore, if you have a readily available Personal Data Inventory, the registration can be finalized within hours. If not, please prepare your Personal Data Inventory as soon as possible.

5- How Can You Help My Organization?

We act as their Data Controller Representative and Contact Person in Turkey. Further, we prepare/update personal data inventories for our clients and make the registration on behalf of our clients.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.