According to Article 16 titled "Exception Criteria" of the Regulation on the Data Controllers Registry, the Personal Data Protection Board ("Board") may grant an exemption from the obligation to register with the Data Controllers Registry, taking into consideration various criteria such as the nature of personal data, the quantity of personal data, the purpose of processing personal data, the field of activity where the personal data is processed, the transfer of personal data to third parties, the legal basis for the processing activity, the retention period of personal data, and the group of data subjects or data categories. Regarding the mentioned exception criteria, it was decided in the Personal Data Protection Board decision dated July 17, 2018, numbered 2018/87, and the decision dated April 2, 2018, numbered 2018/32, to grant exemption from the obligation to register with the Data Controllers Registry ("VERBIS") to data controllers who are not engaged in the main activity of processing sensitive personal data, in addition to those data controllers who were already exempt based on the aforementioned decisions, and who have fewer than fifty employees and an annual financial statement total of less than 25 million TL.
Considering the recent economic conditions in Türkiye, the Personal Data Protection Board has amended the provision in the decision dated 17th July 2018, numbered 2018/87. The phrase "data controllers with fewer than 50 employees and an annual financial statement total of less than 25 million TL, and whose main activity does not involve processing sensitive personal data" has been modified to "data controllers with fewer than 50 employees and an annual financial statement total of less than 100 million TL, and whose main activity does not involve processing sensitive personal data." There have been no changes regarding the employee count; however, a regulation has been made only with respect to the annual financial statement amount. In this context, if the data controller's annual financial statement, as reflected in the corporate tax declaration for legal entities and income tax declaration for individuals for the completed calendar year, reaches the threshold of 100 million TL, the obligation to register with the VERBIS will be become mandatory.
You can access the Board's decision dated 6 July 2023, numbered 2023/1154, through this link.
Information first published in the MA | Gazette, a fortnightly legal update newsletter produced by Moroglu Arseven.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.