Obligation for Registration to Data Controllers Registry: Compulsory Registration Dates and Exceptions

As per Article 16 of the Law on the Protection of Personal Data No. 6698 (“KVKK”), the natural and legal persons that process personal data are obliged to register to the Data Controllers Registry (“VERBIS”) before commencing data processing.

 

According to Article 16/2 of the KVKK, the objective criteria to be determined by the Personal Data Protection Authority (“Authority”) such as the nature of the personal data pertaining to the obligation for registration to VERBIS, the number of the data processing originating from the law or the transfer of data to third parties, may be taken into consideration as an exception.

 

The obligation to register before VERBIS and the criteria for the exceptions to be taken to this obligation are regulated in detail by the Authority which was published in the Official Gazette on December 30th, 2017.

 

In accordance with the decision of Authority No. 2018/32 published in the Official Gazette dated 15.05.2018, the exceptions to the registration obligation of VERBIS are as follows:

 

  1. Those who process personal data only in non-automated ways, as part of any data recording system
  2. Notaries operating in accordance with the Notary Law No. 1512
  3. The associations which established in accordance with the Law on Associations No. 5253, the foundations which established in accordance with the Law on Foundations No. 5737 and the Law No. 6356 on Trade Unions and Collective Labor Agreements which process personal data for members and donors, are limited only to their respective employees and members
  4. Political parties which established in accordance with the Law no. 2820 on Political Parties
  5. Lawyers which in business under the Law No. 1136 on Attorneys’ Act
  6. Independent accountant and financial advisor and certified councillorship which in business under the Law No. 3568 on Certified Public Accountancy and Sworn in Certified Public Accountancy

 

According to the decision of the Authority published in the Official Gazette dated 18.08.2018, the scope of exceptions was extended as follows:

 

  1. Customs Brokers and Authorized Customs Brokers operating under the Customs Law No. 4458
  2. Mediators
  3. Legal entity or real person controllers that have less than 50 employees and a sum of annual balance sheet amounting less than TRY 25 million and do not engage in the processing of sensitive data as their core business activity.

 

Starting Dates of Registration Obligation

 

As per the 2018/88 decision no. 2018/88 issued by the Authority, the deadline for the  date on the obligation to registrationer to VERBIS is determined as follows.

 

Data Controller Start of Registration Obligation Duration for Completion of Records Deadline for Registration
Data controllers having more than 50 employees or annual balance sheet total of more than 25 million TL 01.10.2018 12 Months 30.09.2019
Data controllers residing abroad 01.10.2018 12 Months 30.09.2019
Data controllers having less than 50 employees and annual balance sheet total of less than 25 million TL but their main field of operation is processing of sensitive (special categories of) data. 01.10.2018 15 Months 30.09.2019
Data controllers that are governmental institutions and organizations 01.04.2019 15 Months 30.06.2020