CHANGE IN EXEMPTION CRITERION FOR DATA CONTROLLERS REGISTRATION OBLIGATION

As per the decision of the Personal Data Protection Board published in the Official Gazette dated 18 August 2018 and numbered 2018/87, “real or legal person data controllers with an annual number of employees are less than 50 and their annual financial balance sheet total is less than TRY 25 million and their major activity is not processing special categories of personal data” have been exempted from the obligation to register with the Data Controllers Registry (“VERBIS”).

For the determination of this exemption, the definition of “small enterprise” which was envisaged in the repealed Regulation on the Definition, Qualifications and Classification of Small and Medium-Sized Enterprises (in Turkish, “Küçük ve Orta Büyüklükteki İşletmelerin Tanımı, Nitelikleri ve Sınıflandırılması Hakkında Yönetmelik/Repealed Regulation”) had been taken as basis. However, the Regulation on Small and Medium-Sized Enterprises (in Turkish, “Küçük ve Orta Büyüklükteki İşletmeler Yönetmeliği”) which was published in the Official Gazette on the date of 25 May 2023 and numbered 32201 has defined the “small enterprise” as “Enterprises with less than fifty employees and with an annual net sales revenue or financial balance sheet not exceeding one hundred million Turkish Liras”.

Taking into account the economic conditions of our country, the Board’s decision dated 6 July 2023 and numbered 2023/1154 provides that real or legal person data controllers with an annual number of employees are less than 50 and their annual financial balance sheet total is less than TRY 100 million and their major activity is not processing special categories of personal data, are exempted from the obligation to register with VERBIS.

Accordingly, the below mentioned data controllers shall be obliged to register with VERBIS:

• Data controllers whose number of employees exceed 50 or whose annual balance sheet total (total assets on the balance sheet) exceeds TRY 100,000,000 million;
• Data controllers whose main activity is the processing of special categories of personal data;
• Data controllers residing abroad;
• State Institutions and Organizations.

We would like to kindly submit this updated exemption to your information respectfully.

Our Law Firm remains at your disposal for any further clarifications you may need.

Copyright © 2023 Cailliau&Colakel Attorney Partnership, All rights reserved.