The Personal Data Protection Board, established by the TDPL, extended the initial deadline for data controllers to register with VERBIS from December 31, 2019, to a various dates in 2020 (depending on the type of organization). Below, we provide a chart of the current registration deadlines.
Once a company is registered with VERBIS, the Turkish Data Protection Authority will have the ability to regulate and securitize registered data controllers. This could spur compliance with the TDPL. The public nature of the registry could also spur interest from individuals and increased exercise of individuals’ rights under the TDPL.
Registration with VERBIS can be completed online here. To complete registration, data controllers are required to provide information on their data process, including the purpose of the processing and the recipients to which the personal data may be transferred.2 Any covered data controller (whether a natural or legal person) who does not register with VERBIS by the below-specified deadlines, may be fined 20,000 Turkish Lira (TL) to 1,000,000 TL.3
Turkey’s Personal Data Protection Board has extended the registration deadlines as follows:4
Data Controllers |
Registration Opened |
Registration Deadline |
|
Data controllers with 50 or more employees or who have an annual turnover of more than 25 million TL |
October 1, 2018 Open |
June 30, 2020 |
|
Data controllers who (a) have less than 50 employees; (b) have an annual turnover of less than 25 million TL; and (c) mainly process special categories of personal data (ex. data related to race, religion, genes, biometrics or trade-unions)5 |
January 1, 2019 Open |
September 30, 2020 |
|
Data controllers who are not established in Turkey |
October 1, 2018 Open |
June 30, 2020 |
|
Public Institutions and Organizations |
April 1, 2019 Open |
December 31, 2020 |
1 Certain data controllers are exempt from this registration requirement, including persons processing data by non-automated means under certain conditions, certain political parties, certain lawyers and others. A full list of data controllers exempt from the registration requirement can be found here.
2 Please see Article 16(3) of the TDPL for a full list of the required information.
3 Please see Article 18(d) of the TDPL.
4 Please click here to view the original Personal Data Protection Board resolution.
5 Please see Article 6(1) of the TDPL for a full list of special categories.
