How can we help you to register with Data Controllers' Registry Information System (VERBIS)?

(*) PROVISIONAL ARTICLE 1-(2) Data controllers shall register with VERBIS within the period determined and announced by the Board.

(**) Decision numbered 2018/88 on the extension of VERBIS registration deadlines.

(***) Decision numbered 2019/265 on the extension of VERBIS registration deadlines.

(****) Decision numbered 2019/387 on the extension of VERBIS registration deadlines.

(*****) Decision numbered 2020/482 on the extension of VERBIS registration deadlines.

The provision in the Paragraph (2) of the Article 16 of the Law on Protection of Personal Data No. 6698 is as follows: “Natural and legal persons who process personal data must register with the Data Controllers’ Registry before they start processing data. However, by taking into consideration the objective criteria to be determined by the Board, such as the nature of the personal data processed, the number, the origin of the data processing or the transfer to the third parties, the Board may make an exception to the obligation to register with the Data Controllers’ Registry.” Bearing the following provision in mind as stated in the Paragraph 2 of the Provisional Article 1 of the Law, “Data controllers shall be registered in the Data Controllers’ Registry within the period determined and announced by the Board.”,

it was unanimously decided that

• the starting date for the registration obligation to be given to the natural and legal person data controllers whose annual headcount is more than 50 or whose total annual financial balance is more than 25 million TL to register with the Data Controllers’ Registry as 01.10.2018, and the deadline for the registration to these data controllers to be given as 30.09.2019,

• the starting date of the obligation to register with the Data Controllers’ Registry shall be 01.10.2018 and that the data controllers shall be given a deadline until 30.09.2019,

• the starting date of the obligation to register with the Data Controllers’ Registry shall be 01.01.2019 and the data controllers shall be given a deadline until 31.03.2020 for the natural and legal persons who have less than 50 employees and whose total annual financial balance is less than 25 million TL, in case the main activity of the entity is processing sensitive personal data,

• the starting date of the obligation to register with the Data Controllers’ Registry for public authorities and institutions shall be 01.04.2019 and the deadline for registration shall be 30.06.2020.

• this decision to be announced on the website of the Authority and to be published in the Official Gazette.

As a result of the evaluation of the requests conveyed to the Turkish Personal Data Protection Authority by the Union of Chambers and Commodity Exchanges in Turkey (TOBB) and representatives of various sectors regarding the extension of the registration deadlines for the Data Controllers' Registry, it was unanimously decided that

• the deadline determined for fulfilling the registration obligation to the Registry to be extended until 31.12.2019 for the natural and legal person data controllers with more than 50 employees or a total annual financial balance of more than 25 million TL and natural and legal person data controllers resident abroad,

• this decision to be announced on the website of the Authority and to be published in the Official Gazette.

According to the decision of the Turkish Personal Data Protection Authority (“KVKK”) dated 17.12.2019 and numbered 2019/387, the deadlines of registration obligation for Data Controllers' Registry Information System ("VERBIS") has been extended.

With the relevant decision, it has been concluded that,

• The deadline for fulfilling declaration and notification obligation to Registry for natural and legal person data controllers with an annual number of employees of more than 50 or annual financial balance of more than 25 million TL to be updated as 30.06.2020,

• The deadline for fulfilling declaration and notification obligation to Registry for natural and legal person data controllers resident abroad to be updated as 30.06.2020,

• The deadline for fulfilling declaration and notification obligation to Registry for natural and legal person data controllers with an annual number of employees of less than 50 or annual financial balance of less than 25 million TL and whose main activity is sensitive personal data processing to be updated as 30.09.2020,

• The deadline for fulfilling declaration and notification obligation to Registry for public institutions and organizations to be updated as 31.12.2020.

and this decision to be announced at the website of the Authority and to be published in the Official Gazette.

Due to Covid-19 pandemic, which has an effect in our country as in the whole world, some workplaces are physically closed or a remote /alternate working model is applied, on the grounds that it is not possible to prepare personal data processing inventory for the data controllers, and the controllers could not fulfil the obligation to register with the Data Controllers Registry in due time, as a result of the evaluation of the requests conveyed by Turkish Union of Chambers and Commodity Exchanges (TOBB) and various industry representatives to the Authority for the extension of periods regarding the registration with VERBIS, with the decision of the Turkish Personal Data Protection Board dated 23.06.2020 and numbered 2020/482; it has been decided unanimously that;

• For the natural and legal person data controllers and the natural and legal person data controllers abroad, whose annual number of employees is more than 50 or the annual financial balance sheet total more than 25 million TL, the deadline to fulfil obligation to register with the Registry has been extended to 30.09.2020,
• For the natural and legal person data controllers whose main field of activity is processing of sensitive personal data and whose annual number of employees is less than 50 or the annual financial balance sheet total less than 25 million TL, the deadline to fulfil obligation to register in the Registry has been extended to 31.03.2021,
• For the public institutions and organizations, the deadline to fulfil obligation to register in the Registry has been extended to 31.03.2021,
• The announcement of the mentioned decision to be published on the website of the Authority and in the Official Gazette.

Respectfully announced to the public.