Turkey’s Personal Data Protection Authority has extended the deadline for the registration on the Data Controllers’ Registry System for certain data controllers

Turkey’s Personal Data Protection Authority (“KVKK” or “Authority”) has extended the deadline for the registration on the Data Controllers’ Registry System (“VERBIS”) for certain data controllers on December 17, 2019 with a decision numbered 2019/387.  Accordingly:

1. The deadline for VERBIS registration is extended to June 30, 2020 for the data controllers whose number of annual employees exceeds 50 or whose annual financial balance sum exceeds TRY 25,000,000 and for the data controllers who are resident/established abroad.
2. The deadline for VERBIS registration is extended to September 30, 2020 for the data controllers whose number of annual employees is less than 50 and whose annual financial balance sum does not exceed TRY 25,000,000 but whose main business activity concerns the processing of special categories of personal data.
3. The deadline for VERBIS registration is extended to December 31, 2020 for the data controllers who are public entities or public institutions.

The authority observed that the data officers have been intensively communicated over for the application as to the VERBIS registration in the last days in order to fulfill the registration and notification obligation within the period prescribed. Examination of the recent VERBIS notifications showed that the personal data and processing purposes, recipient / recipient groups, groups subjected to data, technical/administrative and adequate measures, data transfer abroad and data retention periods do not overlap, and most importantly, there are serious mistakes and violations of the law and  regulations.

Accordingly, the authority stated that it is necessary to prepare a “personal data processing inventory” to cover all the procedures in which personal data is processed and to make registration and/or notification based on the prepared inventory, not on a random basis.

The Authority emphasized that the concerned data controller is responsible for the information recorded on VERBIS to be accurate and up-to-date. Additionally, it is reminded that in the event of a change in the information entered in registry, the data controller shall notify the Authority via VERBIS within seven days of the date of the change.

Author: Deniz Çelikkaya