GENERAL INFORMATION
With the decision no. 2019/265, which was decided on September 3, 2019 by the Personal Data Protection Authority (“Authority”) and published on September 5, 2019 via the Authority’s website, it is decided to extend the registration period of data controllers to the Data Controllers’ Registry (“Registry” or “VERBIS”) until December 31, 2019.
PERSONAL DATA PROTECTION LAW
The purpose of Personal Data Protection Law is to protect the fundamental rights and freedoms of persons, privacy of personal life in particular, while personal data are processed, and to set forth obligations of natural and legal persons who process personal data and procedures and principles to comply with for the same. The legal basis of this area is the Law No. 6698 On the Protection of Personal Data (“Law”). Personal data, according to the definition in the Law, can be defined as any information relating to an identified or identifiable natural person (Art. 3/1-d). Moreover, data controller, in accordance with the definition in the Law, is the natural or legal person who determines the purposes and means of the processing of personal data, and who is responsible for establishment and management of the filing system (Art. 3/1-i).
DATA CONTROLLERS’ REGISTRY (VERBIS)
According to the Article 16 of the said Law, natural or legal persons who process personal data shall register with the Data Controllers Registry prior to commencing processing. Registration can be via the website of the Authority (www.kvkk.gov.tr). The data controllers who are required to register in the Registry are as follows;
1. Real and legal person who are controlling data who have more than 50 employees or an annual balance sheet total of more than 25 million TRY
2. Real and legal persons who are controlling data and who are residing abroad
3. Real and legal persons who are controlling and processing sensitive (special categories of) data but having less than 50 employees and an annual balance sheet total of less than 25 million TRY
4. Public institutions and organizations
With the regulation before the date September 3, 2019, the deadline for registration and notification for the data controllers in the first and the second groups had been agreed to be September 30, 2019, March 31, 2020 for the third group and June 30, 2020 for the fourth group.
NEW ANNOUNCEMENT
With the decision no. 2019/265, which was decided on September 3, 2019 by the Authority and published on September 5, 2019 via the Authority’s website, it has been decided to extend the last day of the obligation to register in the Registry is extended to December 31, 2019 for the real and legal person data controllers who have more than 50 employees annually or the total annual financial balance of more than 25 million TRY, and for all real and legal person data officers residing abroad.
The full text of the “Announcement on Extension of Registration Period to Data Controllers’ Registry” dated September 3, 2019 and numbered 2019/265 can be accessed here.
You can contact us for further information and to take advantage of our advocacy and consulting services. You can find detailed information about our office’s work on Information Technology Law, Corporate Law and Consumer Law on our website.
Uçar Law & Consultancy Office
