Time's Up for Turkey
In Turkey, intensive work is underway to implement the Turkish Data Protection Act, as companies above a certain size and turnover must register their data processing activities in the online registration system (VERBIS) by the end of September.
- The Turkish Data Protection Supervisory Authority classifies companies into four mandatory categories for registration in VERBIS:
- Managers with more than 50 employees or an annual balance sheet total of more than TL 25 million.
- Responsible persons based abroad. Start of registration: October 1, 2018 Due date: September 30, 2019
- Data controllers with fewer than 50 employees and an annual balance sheet total of less than TL 25 million, but whose main area of activity is the processing of sensitive (special categories of personal data) data. Start of registration: January 1, 2019 Due date: March 31, 2020
- Responsible persons who are public institutions and organizations. Start of registration: April 1, 2019 Due date: June 30, 2020
Who is exempt?
- Data controllers who process personal data as part of a filing system, but not automatically.
- Associations, foundations and trade unions, insofar as they process personal data of their employees, members, participants and donors within the framework of the relevant legislation and in accordance with their scope of work.
- Lawyers, notaries, auditors and sworn financial advisors.
- political parties.
- Legal entities or natural persons that have less than 50 employees and an annual balance sheet total of less than TRY 25 million and do not deal with the processing of sensitive data as their core business activity.
- Mediators.
- Customs brokers authorized under Customs Act No. 4458.
If those responsible do not complete the registration in time, they face fines of between TL 20,000 (approx. EUR 3,250) and TL 1 million (approx. EUR 162,000)
If you need help with registration, we will be happy to help you!
from D. Onur
Further information: kvkk.gov.tr/Icerik/5490/VERBIS-e-Kayitlar-Devam-Ediyor-