In this information, information is given about the exceptions to the obligation to register to the Registry in line with the Decision No. 2018/87 of the Personal Data Protection Board and the application periods within the framework of the obligation to register to the Data Controllers Registry (VERBIS / Registry) in the light of the Board’s decision No. 2018/88.
Pursuant to paragraph 2 of Article 16 titled “Data Controllers Registry” of the Law No. 6698 on the Protection of Personal Data (Law),
“Natural and legal persons who process personal data are obliged to register with the Data Controllers Registry before starting data processing. However, the Board may make exceptions to the obligation to register with the Data Controllers Registryby taking into account objective criteria to be determined by the Board, such as the nature and number of personal data processed, the lawfulness of the data processing or the status of transfer to third parties .”
According to paragraph 2 of the provisional article 1 of the Law,
“Data controllers are obliged to register with the Data Controllers Registry within the period determined and announced by the Board.”
Accordingly, with the decision numbered 2018/87, the Personal Data Protection Board decided that in addition to notaries, associations and foundations, political parties, lawyers, certified public accountants and sworn public accountants, real or legal person data controllers whose annual number of employees is less than 50 and whose annual financial balance sheet total is less than 25 million TLwill be exempted from the obligation to register with the Data Controllers Registry for those whose main activity is not processing special categories of personal data.
In terms of data controllers who are not exemptedfrom the registration obligation , the Personal Data Protection Board, with its decision numbered 2018/88, announced the starting dates of the registration obligation to the data registry information system (VERBIS), which is the information system created by the Presidency of the Personal Data Protection Authority, which can be accessed via the internet, which data controllers will use in the application to the Registry and other transactions related to the Registry.
According to this judgement;
- The starting date of the obligation to register with the Data Controllers Registry for real and legal person data controllers whose annual number of employees is more than 50 or whose annual financial balance sheet total is more than 25 million TL is 01.10.2018, and these data controllers are given until30.09.2019 to register with the Registry .
- The starting date of the obligation to register with the Data Controllers Registry for real and legal person data controllers residing abroad is 01.10.2018, and these data controllers have been given until30.09.2019 to register with the Registry .
- The starting date of the obligation to register with the Data Controllers’ Registry for natural and legal person data controllers whose main activity is the processing of special categories of personal data, although the annual number of employees is less than 50 and the annual financial balance sheet total is less than 25 million TL, is 01.01.2019, and these data controllers have been given until31.03.2020 to register with the Registry .
- The starting date of the obligation to register with the Data Controllers Registry for public institutions and organisations data controllers is 01.04.2019 and these data controllers are given until30.06.2020 to register with the Registry .
As a result, VERBIS, which is currently in the testing phase, will be put into use as of 1 October 2018.
According to the Board’s decision, data controllers with more than 50 employees or a total annual financial balance sheet of more than TRY 25 million and natural and legal person data controllers residing abroad must have completed the application and registration procedures to VERBIS between 1 October 2018 and 30 September 2019. Although the annual number of employees is less than 50 and the annual financial balance sheet total is less than 25 million TL, data controllers whose main field of activity is processing special categories of personal data must apply and register with the Registry between 1 January 2019 and 31 March 2020.
Among the data controllers with less than 50 employees and less than 25 million TL annual financial balance sheet, those whose main field of activity is not processing special categories of personal data are exempted from the obligation to register with the Data Controllers Registry by the Board decision.
For your information.
