According to Article 16 of the Law, an obligation to register in the Data Controllers Registry (“VERBIS”) has been introduced for data controllers.
In 2018, the Board issued decisions granting exemptions from the registration obligation to specific professional groups, associations, and political parties. The Board also granted a general exemption to data controllers residing in Turkey with less than 50 employees and less than TRY 25 million on their balance sheets.
Data controllers residing abroad must also be registered with the VERBIS, so long as they process personal data in Turkey.
The most important obligation regarding the VERBIS is that a data controller must prepare a personal data inventory before registering.
Every data controller must thoroughly review its activities and determine the purposes of the data processing activity, category of personal data, recipients, retention periods, international transfers, data security measures, and legal grounds for data processing while preparing a data inventory.
Data controllers residing in Turkey and meeting the conditions above for registration obligation to the VERBIS must appoint a contact person. It is important to note that the Turkish subsidiaries of foreign companies meeting the conditions mentioned above for registration to the VERBIS must also appoint a contact person if such subsidiaries process personal data. This individual’s name and contact details will be published online, and they will be responsible for establishing the communication between the data subjects and the data controllers.
On the other hand, data controllers residing outside Turkey must also appoint a data controller representative. The representative may be either a Turkish resident legal entity or an individual with Turkish nationality. The representative must be appointed via a data controller’s resolution, which needs to be notarised and apostilled (or otherwise legalised). The representative will act as a point of contact for the data controller about its dealings with the Board, the DPA and the data subjects. If a legal entity is appointed as the representative, the foreign data controller must also appoint a real person as the contact person.
Data controllers who do not fulfil the obligation to register with the VERBIS will be sentenced to an administrative fine of between TRY 119,436 and TRY 5,972,040 (Based on the updated amounts for 2023).