THE TURKISH DATA PROTECTION AUTHORITY DECLARED NEW DEADLINE FOR REGISTRATION TO THE VERBIS!

09.09.2019

The Decision of the Personal Data Protection Board was published in the Official Gazette dated 07.09.2019 , numbered 30881. Accordingly;

The period for the registration to Data Controllers’ Registry (VERBIS) has been extended until 31.12.2019[1].

 

What is Data Controllers’ Registry (VERBIS)?

It is a registration system where data controllers shall be registered to and record the data processing activities they are engaged with. Data controllers must register with the Registry which is held by the Authority under the supervision of the Board[2]

What are the Requirements for the Registration?

Data controllers shall provide the following information to register with the VERBIS:

  • Identifying information (including the address of the data controller or its representative).
  • The purpose of the data processing.
  • The data subject groups and data categories
  • Recipient or recipient groups to which the data may be transferred.
  • Any personal data which may be transferred abroad.
  • The data security measures taken.
  • The maximum time for processing personal data (which must be in accordance with the purpose of the data processing). 
  • Personal Data Processing Inventory should be prepared before the registration in order to be compliant with the legislation and to make the process easier and faster.

In case of any change in the information listed above, such change shall be immediately notified to the Data Protection Authority (“Accuracy Principle”; data be ‘accurate’‘kept up to date’ and ‘erased or rectified’ when inaccurate.)

What is the Sanction of Non-compliance?

It is regulated under article 18, titled as ‘Misdemeanours’, of the Law on the Protection of Personal Data numbered 6698. In case of non-compliance with registration, the data controller may be applied administrative fines of 20.000 Turkish Liras to 1.000.000 Turkish Liras.

You can reach the Decision (in Turkish) here.

Should you have any queries and/or remarks, please do not hesitate to contact us. 

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr


[1] Previous regulation (deadline) was as follows :

Data controllers who employ more than 50 employees in a year or whose total annual financial statement is more than 25 million Turkish Liras, and data controllers who are not resident in Turkey must be registered to the VERBIS until the date of 30.09.2019.

[2] The Regulation on Data Controllers’ Registry was published in the Official Gazette dated 30.01.2017, numbered 30286.