As you might be aware, Law on Protection of Personal Data (“Law”) is a law that is in effect and applicable as of April 07, 2016. Pursuant to the Law, all (foreign or Turkish) real and legal persons that determine the purposes and instruments for processing of personal data and that are responsible for establishment and management of the data registration system are defined as “data controller”.

According to the Law, all data controllers must be registered to the Data Controller Registry (“VERBİS”) until 30.09.2019, except for the exceptions announced by the Personal Data Protection Board (such exceptions are stated below*).

We would like to remind you that it is important to become fully compliant with the Law prior to completion of registration to VERBİS, since it will be requested during the registration stage to provide information such as the type and category of processed personal data and type of technical and administrative measures taken regarding such data.

Lastly, we would like to remind you that an administrative fine in an amount between TRY 29.410 and TRY 1.470.583 (those amounts are determined for 2019) in the event the liability to register to VERBİS is not fulfilled. Additionally, high amounts of administrative fines may be applied if it is acted against certain other liabilities within the scope of the Law.

You may send e-mail to Batuhan Şahmay ([email protected]) if you have any request/question.

* Exceptions to the registration to VERBİS are as follows:

  • A real/legal person which has (i) less than 50 employees annually and (ii) less than TRY 25 million annual financial balance (provided that the main activity of them are not processing of sensitive personal data) is excluded from the liability to register to Registry.
  • Custom brokers and mediators are also excluded from the obligation to be registered to the Registry.
  • Commencement dates for the obligation for the registration to the Registry are revised as follows:
Data ControllerCommencement date for the registration obligationPeriod granted for registrationLast date for registration
Real and legal person data controller which has (i) more than 50 employees annually or (ii) more than TRY 25 million annual financial balance01.10.201812 months30.09.2019
Real and legal person data controllers located abroad01.10.201812 months30.09.2019
Real/legal person data controller which has (i) less than 50 employees annually and (ii) less than TRY 25 million annual financial balance and of which the main area of activity is processing of sensitive personal data01.01.201915 months31.03.2020
Public institution and organization data controllers01.04.201915 months30.06.2020

(*) TEMPORARY ARTICLE 1 – (2) Data controllers are obliged to register to the Data Controller Registry within the period determined and announced by the Board.