fbpx

Developments in the Obligation of Registration to Data Controllers’ Registry


In accordance with Personal Data Protection Law No. 6698 (the “DPL”) and the Regulation on Data Controllers’ Registry (“Regulation”), data controllers shall get registered to the Data Controllers’ Registry (“VERBIS”).

In terms of the private sector, periods regarding the registration obligation has expired as of 31.12.2021 for (i) data controllers located outside of Turkey, (ii) data controllers having more than 50 employees annually or an annual balance sheet with a value more than TRY 25 million, and (iii) data controllers whose main field of activity is processing of sensitive personal data. Administrative fines are imposed against the relevant data controllers who fail to comply with their registration obligations until this date.

The Personal Data Protection Board (“Board”) actively monitors data controllers located in Turkey in the light of notifications made to the Social Security Institution and tax offices, and imposes administrative fines on data controllers who exceed the thresholds without even warning if they are not registered with VERBIS. The Board also investigates the data controllers located abroad and processing the data of persons located in Turkey, and imposes fines on these data controllers too.

Even if there is a risk of administrative fine in case of late registration, it is suggested that all data controllers who meet the conditions but have not complied with their registration obligation yet should register to VERBIS as soon as possible.

Your Registration Obligation Has Just Begun/May Begin

Data controllers who do not meet  the conditions before 31.12.2021 may also become or will become obliged to registration after 31.12.2021.

We suggest that all real and legal persons located in Turkey check the monthly Witholding and Premium Service Declarations and the financial statements attached to the annual income or corporate tax declarations which are provided to public institutions and organizations in 2021 and 2022.

According to the information given to public institutions within the scope of these declarations, the following data controllers will also need to get registered:

  1. If the number of employees reported in each of at least 7 of the 12 months in a completed year is more than 50, the registration obligation will begin. The annual number of employees will be calculated according to this criterion. The relevant 7 months do not obliged to be consecutive months either. All real and legal persons who report more than 50 employees in any 7 or more months in the same year are obliged to get registered.
  2. If the value in the "asset" or "liability" section of the balance sheet submitted/to be submitted in the annex of the tax declaration for a completed year is higher than TRY 25 million, the registration obligation will begin.

One of the two conditions must be met for VERBIS registration obligation to begin for data controllers located in Turkey. The data controllers shall closely monitor whether these conditions are met or not in the following years too.

Data controllers, who are not obliged to registration, but later become obliged to registration must register to VERBIS within 30 days of the date they meet one of these conditions.

What should be done for VERBIS Registration?

In brief and primarily, the following must be done for VERBIS registration:

  • A clear, updated, and accurate data processing inventory shall be prepared as to include information related to the purpose of data processing, data category, the data recipients, and the maximum time period required for the purpose of processing, data to be transferred abroad and measures to be taken for data security.
  • Data controllers located outside Turkey shall appoint a local data controller representative in Turkey. You may contact us any time for more information about our services to provide local representation for our clients with respect to the registration obligation.
  • Data controllers located in Turkey and data controller representatives shall determine a real contact person in order to complete their registration purposes. The contact person shall be a Turkish citizen and resident in Turkey as well. A contact person appointed for one data controller located in Turkey cannot be determined as a contact person for other Turkish resident data controllers. This restriction is not applicable for data controllers located outside Turkey.

Keeping Inventories and VERBIS Forms Updated

In the current situation, all data controllers are required to keep their personal data processing inventories updated, and data controllers who have completed their VERBIS registration before the previous deadline also need to re-evaluate the information sunmitted to VERBIS within the scope of updates they will make in their inventories.

Keeping the inventory and the information submitted to VERBIS updated is very crucial and every new data processing should be reflected in the company’s inventory and updated in VERBIS if it has been registered to VERBIS before. The registration of new data processing periods must also be completed within 30 days from the beginning of the relevant data processing.

Increasing Sanctions

In case that a data controller subject to VERBIS registration obligation fails to comply with this obligation and to reflect the updated data processing to the VERBIS form, an administrative fine for 2022 between TRY 53,572 and 2,678,863 may be imposed against the relevant data controller. Since the revaluation rate has been determined as 122.93% for 2022, administrative fines will increase at this rate in 2023 and will be between minumum TRY 65,856 and TRY 3,293,126.

The higher is the value of total assets shown in the financial statements of the data controllers who fails to comply with their obligations fines, the closer to the upper limit the sanction amount will be as a result of the algorithm used by the Board to determine the amount of fines to be imposed.

Suggestions

We suggest that all data controllers located abroad and processing the personal data of persons located in Turkey and all data controllers in Turkey who exceed the thresholds for the number of employees and the total balance sheet should take action as soon as possible to get registered with VERBIS. Especially, we would like to emphasize that the thresholds do not apply for foreign data controllers and these data controllers are subject to this obligation regardless of the number of employees and balance sheet totals.

If you have any questions and need our any assistance, you may contact us any time.

Special thanks to Yasemen Öner for her contributions.

Find more insights

Share