Newsletter Regarding Turkish Data Protection Law
The Turkish Data Protection Authority (“DPA”) has announced the decision dated 19/07/2018 and numbered 2018/88 in the official gazette dated 18.08.2018 and numbered 30513 regarding the deadline for registration with the Data Controller Information System (“VERBIS”). Based on the decision;
•Data controllers who have more than 50 employees or their sum of financial balance sheet is more than 25.000.000, -TL shall register with the VERBIS as of 1 October 2018 and onwards. Deadline for such registration is 30 September 2019.
•Data controllers who carry out data protection activities that concern Turkey or Turkish Citizens; but who are based outside of Turkey, must appoint a representative in Turkey and register with the VERBIS as of 1 October 2018. Deadline for such registration is 30 September 2019.
•Data controllers who have less than 50 employees and their sum of financial balance sheet is less than 25.000.000, -TL, but who process sensitive personal data shall register with the VERBIS as of 1 January 2019. Deadline for such registration is 31 March 2020.
•Data controllers who are public institutions and organizations shall register with the VERBIS as of 1 April 2019. Deadline for such registration is 30 June 2020.
As per the Law on The Protection of Personal Data (the "Law"), “DPA” had been given the authority to bring an exception to the obligation of registry. Regarding the application of exception; the nature and the number of the processed personal data, the origin of the data processing device or the status of data transfer to third parties shall be taken into consideration. DPA had been previously announced data controllers who are not obliged to register with the VERBIS. According to the DPA’s decision dated 02/04/2018 and numbered 2018/32, Data Controllers that process personal data only through non-automated means, notaries, associations, foundations, trade unions, political parties, attorneys at law, independent accountants and financial advisors and certified public accountants are not obliged to register of the VERBIS.
“DPA” has also introduced additional exceptions to the obligation to registry with the VERBIS with three more decisions.
As per the latest decisions which are published in official gazette dated 18.08.2018 and numbered 30513, following data controllers have been exempted from the registry obligation with the VERBIS;
•Arbitrators with the decision dated 05/07/2018 and numbered 2018/75,
•Customs consultants with the decision dated 05/07/2018 and numbered 2018/75,
•Data controllers who have less than 50 employees and their sum of financial balance sheet is less than 25 million TL and who do not process sensitive personal data with the decision dated 19/07/2018 and numbered 2018/87.
For further information, please kindly contact us.
Att.Melis ÖZSAN