The Turkish Data Protection Authority Publishes a Public Announcement on the Data Controllers Registry

The Turkish Data Protection Authority (“The Authority") has recently published the public announcement ("The Announcement") on the Data Controllers Registry ("VERBIS") on the official website of the Authority

According to the Announcement;

• According to Article 16 of the Law No. 6698 on the Protection of Personal Data ("Law"), "(1) Under the supervision of the board, the Data Controllers Registry is kept publicly by the presidency. (2) "Real and legal persons/entitites who process personal data are obliged to register with the Data Controllers Registry before starting data processing.", it is found that real and legal person data controllers who process personal data have the obligation to register and notify VERBIS,
• Pursuant to the provisional Article 1 of the law, "Data controllers are obliged to register with the Data Controllers Registry within the period determined and announced by the Board." Pursuant to the Decision of the Personal Data Protection Board ("Board") dated 11.03.2021 and numbered 2021/238, all data controllers not covered by the exception must have fulfilled their registration and notification obligation to VERBIS until 31.12.2021,
• "(ç) Those who violate the obligation to register and notify the Data Controllers Registry stipulated in Article 16 shall be imposed an administrative fine from 20,000 Turkish Liras to 1,000,000 Turkish Liras. " and in the third paragraph of the same article, "In the event that the acts listed in the first paragraph are committed within public institutions and organisations and professional organisations in the nature of public institutions, upon notification by The Board, action shall be taken against the civil servants and other public officials working in the relevant public institutions and organisations and those working in professional organisations in the nature of public institutions in accordance with the disciplinary provisions and the result shall be notified to the Board,
• The Board continues to carry out VERBIS examinations in accordance with Article 18 of the law for approximately 16,350 data controllers who are determined to have failed to fulfil this obligation among approximately 130,600 data controllers who are determined to have registration and notification obligations to VERBIS, and to impose administrative fines based on the algorithm table prepared according to the annual financial balance sheet total assets as a result of the examination,
• Following the aforementioned inspections, Tthe Board has imposed an administrative fine of 503.935.000 TL as of 01.08.2024 on real and legal person data controllers residing in Turkey and abroad who do not fulfil this obligation although they have the obligation to register and notify VERBIS, and disciplinary provisions are also applied to public institutions and organisations and professional organisations in the nature of public institutions.

You can access the full text of the Announcement here .

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr