U nder Law No. 6698 on the Protection of Personal Data, data controllers are obligated to register with the Data Controllers Registry, which was established in accordance with the same law. The details of which data controllers are subject to VERBIS registration obligations, exceptions, and registration deadlines are shaped by decisions made by the Personal Data Protection Authority (KVKK).
Which Data Controllers are Subject to VERBIS Registration Obligation?
- Natural and legal persons who have more than 50 employees annually or whose annual financial balance sheet total exceeds 25 million Turkish Liras (TL),
- Natural and legal persons established abroad,
- Natural and legal persons whose annual number of employees is fewer than 50 or whose annual financial balance sheet total is less than 25 million TRY but whose main activity is the processing of special category personal data.
When Does the VERBIS Registration Obligation End?
According to the decision of the Personal Data Protection Authority dated July 19, 2018, and numbered 2018/88:
- Natural and legal persons who have more than 50 employees annually or whose annual financial balance sheet total exceeds 25 million TRY must fulfill their VERBIS registration obligation by September 30, 2019, at the latest.
- Natural and legal persons established abroad must fulfill their VERBIS registration obligation by September 30, 2019, at the latest.
- Natural and legal persons whose annual number of employees is fewer than 50 or whose annual financial balance sheet total is less than 25 million TRY but whose main activity is the processing of special category personal data must fulfill their VERBIS registration obligation by June 30, 2020, at the latest.
What Are the Exceptions to the VERBIS Registration Obligation?
The Personal Data Protection Authority has exempted certain professional and business areas from the VERBIS registration obligation through its decisions.
According to the decisions made by the authority, notaries, political parties, lawyers, independent accountants and financial advisors, sworn-in certified public accountants, customs consultants, and mediators are exempted from the obligation.
Associations, foundations, and unions are only exempted if they process personal data limited to their scope of activities and only in relation to their employees, members, affiliates, and donors.
It is important to note that data controllers who are not subject to the VERBIS registration obligation or those who are exempt from it are still subject to all other obligations imposed by the Law on the Protection of Personal Data.
How Is the VERBIS Registration Obligation Fulfilled?
Data controllers subject to the VERBIS registration obligation must first fulfill all the obligations stipulated in the Law on the Protection of Personal Data. Accordingly, data controllers must establish all technical and administrative arrangements and register in the registry with the personal data inventory resulting from these arrangements. The data controller’s personal data disclosure, retention, and deletion policies are also based on this inventory. Therefore, the fulfillment of the VERBIS registration obligation is only possible once the compliance process for the protection of personal data is completed.
The VERBIS registration obligation for data controllers does not end with registry registration. Data controllers must also keep the registry updated with all notifications regarding the implementation and changes of their policies. In this sense, it should be emphasized that the VERBIS registration obligation is not a one-time administrative procedure but a living and continuously updated practice.
What Are the Sanctions for Non-Compliance with the VERBIS Registration Obligation?
Under the Law on the Protection of Personal Data, data controllers who fail to fulfill the VERBIS registration or post-registration notification obligations may be subject to administrative fines ranging from 29,000 Turkish Liras (TL) to 1,470,000 TL, as of 2019.
The VERBIS registration obligation is an administrative obligation related to the protection of personal data. However, the main goal is to establish a new order aimed at promoting a culture of personal data protection. In this sense, the Personal Data Protection Authority has made numerous decisions and conducted serious inspections on the matter. For data controllers subject to the VERBIS registration obligation, it is crucial to correctly determine their personal data policy before registering in the registry and to act in accordance with their policy after registration. Therefore, it is highly recommended that data controllers seek professional assistance regarding their technical and legal obligations.
