Lawyer Meryem Kılıç-Lawyer Ayşe Hüma Lofça

»According to article 16 of the 6698 numbered Law on the Protection of Personal Data, legal persons who process personal data are required to enroll in the Registry of Data Controllers before proceeding with data processing. Although registration is foreseen, some legal persons are held exempt from this rule. This topic will be discussed in detail below.

»As it will be explained below, those who are not exempt from registration are under legal obligation to enroll in the Registry of Data Controllers before beginning data processing. For this reason the examination of the enrollment process of legal persons is useful and will be done in the order of exceptions and non-exceptions.

Exceptions to the Data Controllers Registry (VERBIS)

»Article 16 of the Personal Data Protection Law has generally outlined those under obligation to register; leaving room for the Board to interpret those who are exempt. The Board, using its discretion power, has listed these exceptions to enrollment in its 02.04.2018 dated and 2018/32 numbered decision as shown below;

• Those who, while are a part of a registration data segment but process personal data only by non-automatic means.

• Notaries

• Organizations, foundations and unions whom process data limited only with their field of activity and only in accordance with the related legislation and purposes.

• Political Parties,

• Attorneys at Law and Legal Advisers,

• Independent Accountant Financial Advisers and Sworn-in Public Accountants.

»In addition to the list above, the Data Protection Board may determine exceptions based on criterias such as the nature of the personal data, the quantity of personal data, the purpose of processing the personal data, the field of practice in which the personal data has been processed, the status of data transfer to third parties, the legal basis of personal data processing, the retention span of the data and the data subject or category. The Board announces these criteria to the public with the appropriate procedure.

General Information About The Registry Of Data Protection

»It should be pointed out that enrollment may only be done online, written applications are not accepted. There are three application categories at VERBİS; Legal Person Residing in Turkey, Legal Person Residing Abroad, Public Institutions and Organizations. Legal persons residing in Turkey may apply directly while legal persons residing abroad may only apply through an authorized representative.

Steps to Follow While Registering to VERBİS

»Enter the Personal Data Protection Authority website(www.kvkk.gov.tr).

»Click the VERBİS button on the top left. Scroll down and click “For VERBİS’ Page”. Please note that the application must be done in Turkish.

»Select the “Veri Sorumlusu Yönetici Girişi” button. This will direct you to the controller entry. Choose the register button, “Kayıt olun”.

»Next you will be directed three options; Yurtiçinde Yerleşik Tüzel / Gerçek Kişi (Legal / Natural Person Residing in Turkey), Yurtdışında Yerleşik Tüzel / Gerçek Kişi (Legal/ Natural Person Residing Abroad), Kamu Kurumu (Public Establishment). Please select your corresponding status. According to your status, the necessary information will be filled out with the title controller, authorized representative or coordination officer determined by public establishments. This form will be signed with a wet signature or with a KEP address (a registered electronic mail address) and sent to the Board.

»During registration, the following information of the Data Controller is required;

• Identification and address information,

• The purpose of data processing,

• The group or groups subject to data processing and statements about these persons’ data categories,

• Recipient or recipient groups to which the personal data may be transferred,

• Personal data which may be transferred to foreign countries,

• Precautions taken regarding personal data protection,

• The maximum time period required to process the data according to the purpose,

• If available, a KEP address (registered electronic mail address).

»After filling out the information above, the controllers must deliver the form either by shipping, hand delivery or with the KEP address.

The Data Controllers’ Notification Duty After Completing The Registration Process

»The controllers must login to VERBİS using the “username” and “password” provided by the Board and reports their registration.

The Registration Period to the Data Controllers Registry VERBIS

»It is highly important to point out that if those who must have been registered by 30.09.2020 weren’t able to fulfill their registration obligation due to actual, technical or legal impossibilities, the Board has given time to fulfill the registration obligation with a letter. Within the period notified to them by the Board in said letter, the data controllers are required to fulfill their registration obligation to the Registry. (Board’s decision dated 01.10.2020 and numbered 2020/760)

Enforcement Of Non-registration to The Data Controllers Registry (VERBIS)

»Article 18 of Law on the Protection of Personal Data states that Administrative fines from 20,000 TL to 1,000,000 TL may be imposed on data controllers who fail to fulfill their obligation to register and notify VERBIS. Therefore, in order to avoid this sanction, the relevant data controllers must complete their VERBIS records until the dates shown above.

Change Of Information in the Data Controllers Registry

»Any change that may occur must be reported to the Board through VERBİS within seven days of the change.