EN-US 
TR-TR 
Turkey’s Personal Data Protection Board (“Board”) in its latest ruling, resolved that derogation from the obligation of registration with the Data Controllers’ Registry, will apply to associations, foundations and trade unions residing in Turkey who process personal data only in accordance with the relevant legislation and purposes, limited to their fields of activity, and those who do not have any commercial enterprises affiliated to them.
Legal Basis and the Subject of the Ruling
First of all, it is emphasized in the ruling that, natural or legal persons who process personal data shall register with the publicly available Data Controllers’ Registry prior to the commencement of data processing pursuant to the Personal Data Protection Law numbered 6698 (“Law No. 6698”). However, it is also emphasized that the Board may provide derogation from the obligation of registration with the Data Controllers’ Registry by taking into account different objectives such as the nature and quantity of the data or transferring the data to third parties. In furtherance of the related regulation under the Law No. 6698, with the Board’s previous ruling numbered 2018/32, associations, foundations and trade unions that only process personal data in accordance with the relevant legislation and purposes, limited to their fields of activity and only for their own employees, members, and donors, were exempted from this obligation to be registered with the Data Controllers’ Registry.
Nevertheless, upon the statements given to the Turkey’s Personal Data Protection Authority that there were hesitations about the obligation to register with the Data Controllers’ Registry of commercial enterprises belonging to foundations, associations or trade unions, the Board decided to evaluate this issue.
The Board’s Approach
In furtherance of significant considerations, the Board resolved to alter its approach in its previous ruling numbered 2018/32. Therefore, it held that derogation from the obligation of registration with the Data Controllers’ Registry, will apply to associations, foundations and trade unions residing in Turkey who process personal data only in accordance with the relevant legislation and purposes, limited to their fields of activity, and those who do not have any commercial enterprises affiliated to them.
In conclusion, the Board decided that associations, foundations, and trade unions who have a commercial enterprise affiliated to them residing in Turkey that process personal data, limited only to the relevant legislation and their fields of activity, must register to the Data Controllers’ Registry and only enter information about the activities of their commercial enterprises during their registration process.
Ezgi Ceren Aydoğmuş
