Pursuant to Turkish Data Protection Law (Law No. 6698), a data controller, either a real person or a legal entity, must be registered to the Registry of Data Controllers known as VERBİS. In this regard, the deadline to fulfil the obligation to register with VERBİS has been announced by Turkish Personal Data Protection Board (“Board”).
The Board has published a public announcement on its website on October 1, 2020. Accordingly, the data received from Ministry of Treasury and Finance confirms that as of October 1, 2020, some of the data controllers whose annual number of employees are more than 50 or the total amount of annual balance sheet is more than 25 Million Turkish Lira, have not yet submitted an application to VERBIS or have not completed their statement after their application.
The Board considered the technical and legal impossibilities amid pandemic and has decided to give a written notice to the data controllers who have not registered. The notification requires data controllers to fulfil their registration obligation with VERBIS within the time limit given by the Board.
On the other hand, time limits have been extended for public institutions and real person or legal entity data controllers for those whose annual number of employees are less than 50 and the total amount of annual balance sheet is less than 25 Million Turkish Lira, as well as who are processing sensitive personal data as its field of activity. According to the Board’s Decision on June 23, 2020 (No. 2020/482), above mentioned data controllers should fulfil the registration obligation until March 31, 2021.
