EN 
TR 
Turkish Personal Data Protection Board (“Board”) expanded its Data Controllers Registry Information System (“VERBIS”) exemption for foundations, associations, and unions. Pursuant to the Board’s Decision numbered 2018/32 dated April 2, 2018 (“Decision 2018/32”), foundations, associations, and unions which is established within the scope of specific related legislation were already exempted from their obligation stipulated under the Article 16 of the Law on the Protection of Personal Data No. 6698 (“Law No. 6698”) for their processing activities limited to personal data of their employees, members, affiliated ones, and benefactors.
As per the recent Decision numbered 2020/315, the Board rescoped such exemption to all processing activities made by foundations, associations, or unions that process personal data in line with their establishment legislations and purposes within the scope of their activity fields without any specific limitation regarding the categorizes of data subjects.
Background
Pursuant to the Article 16 of the Law No. 6698, data controllers in Turkey are required to register to VERBIS on which data controllers record their data processing activities. Data controllers are required to provide the following information to VERBIS:
– Identifying information (including the address of the data controller or its representative).
– The purpose of the data processing.
– The data subject groups and data categories.
– Recipient or recipient groups to which the data may be transferred.
– Any personal data which may be transferred abroad.
– The data security measures taken.
– The maximum time for processing personal data (which must be in accordance with the purpose of the data processing).
Pursuant to the Decision 2018/32, the persons that process personal data only by non-automated means, lawyers, notaries, political parties, certified public accountants, and independent accountants were also exempted from the obligation stipulated under the Article 16 of the Law No. 6698.
Author: Aslı Naz Ünlü
