DEADLINE REMINDER FOR THE REGISTRATION WITH THE DATA CONTROLLERS REGISTRY (VERBIS)
As you may remember from our Newsletter dated 16 March 2021, we informed that pursuant to the decision dated 11 March 2021 and numbered 2021/238 of the Personal Data Protection Authority published on 16 March 2021 in the Official Gazette, the postponed deadline for the registration with the Data Controllers Registry (VERBIS) is approaching.
What is VERBIS?
VERBIS (in Turkish, “Veri Sorumluları Sicil Bilgi Sistemi”) is Data Controllers’ Registry Information System; a registration platform which real or legal persons who process personal data are required to register before they commence the data processing within Turkey.
We would like to remind you of the deadline for the following which will expire on 31 December 2021 (unless it is extended once again with a new decision):
| Data Controllers | Deadline |
| Data controllers whose annual number of employees exceeds 50 or whose annual balance sheet total (total assets on the balance sheet) exceeds TRY 25 million | 31.12.2021 |
| All real persons or legal entities processing personal data of any Turkish resident as data controllers located outside Turkey irrespective of their number of employees and balance sheet value, | 31.12.2021 |
| Data controllers whose (I) number of annual number of employees is lower than 50 and whose annual balance sheet total (total assets on the balance sheet) is lower than TRY 25 million and (ii) whose main field of activities is processing sensitive personal data (in Turkish, “özel nitelikli kişisel veri”) | 31.12.2021 |
| Public Institutions and Organizations, Professional Organizations with Public Institution Status (in Turkish “Kamu Niteliğindeki Meslek Kuruluşu”) | 31.12.2021 |
In order to complete the registration, the data controller must fulfill the following:
- Data Controller’s (and if available, its Representative’s) identification and address information
- Purpose of data processing
- Explanation regarding the data subject group(s) and data categories
- Data receivers and data receiver groups which the data may be transferred to
- Personal data presumed to be transferred abroad
- Precautions taken for the security of the personal data
- Maximum period of time for which the data will be processed
The said information shall be prepared based on the Personal Data Processing Inventory. Accordingly, data controllers are also under the obligation to prepare a Personal Data Processing Inventory.In case that a data controller subject to VERBIS registration obligation fails to comply with this obligation, according to Article 18 of the Law numbered 6698 on the Protection of Personal Data, an administrative fine between TRY 39,337 (approximately EUR 3,900) and TRY 1,966,862.00 (approximately EUR 190,000) for the year 2021 may be imposed against the relevant data controller.
Please note that Data Controllers may send their applications for registration through their Electronic Registered E-email (in Turkish “KEP”), to the address of kvkk.verbis@hs01.kep.tr. It would suffice to indicate the application number in the “subject” of the e-mail. Submission of documents with wet signature is not required by the Personal Data Protection Authority. Thereafter, the allocated username and password will be sent to the Data Controller’s e-mail address provided in the application form, to be followed through the system athttps://verbis.kvkk.gov.tr/ .
Please also note that Data Controllers who process personal data only through manual means (non-automatic), provided that such data is part of a data recording system, are excluded from the obligation to register to VERBIS.
For detailed information regarding VERBIS, the relevant data controllers may review the Guidelines for Data Controllers’ Registry Information System for their registration processes. The guidelines are available in Turkish from the below link:
Our Law Firm remains at your disposal for any further clarifications you may need.