Administrative Fines Have been Initiated by the Turkish DPA Against Data Controllers Who do not Fulfill Their Registration Obligation to the VERBIS

As is known, with the Decision of the Turkish Personal Data Protection Authority (“the Turkish DPA”) dated 11/03/2021 and numbered 2021/238; natural person and legal entity data controllers with an annual employee count of more than 50 or an annual financial balance sheet totaling more than 25 million Turkish Liras with Natural person and legal entity data controllers based abroad have an annual employee count of less than 50 and an annual financial balance sheet of less than TL 25 million, and real and legal person data controllers whose main activity is privately qualified personal data processing, Public Agency and Organization and Public Professional Organization data controllers who are public institutions have been given until 31.12.2021 to fulfill their obligation to register and notify the Data Controllers’ Registry (“the VERBIS or Registry”).

In accordance with the provision of Article 18 (1) of the Personal Data Protection Law (“the Law”), administrative fines may be applied by the Turkish DPA against data controllers who do not fulfill the obligation to register and notify the Registry.

The relevant legal article regulation is as follows; “ç) For those who act contrary to the obligations for registry with the Data Controllers’ Registry and for notification provided for in Article 16 shall be imposed to pay an administrative fine of 20.000 to 1.000.000 TL.”

In this context, administrative fines have been started to be applied against data controllers who are found not to have fulfilled their registration and notification obligations to the Registry in accordance with Article 18 of the Law.

You can reach further information here.

Kind regards,

Zumbul Attorneys at Law

info@zumbul.av.tr