Protection of personal data in Turkey

When we look at the world history, humanity previously had to deal with epidemic diseases. These were finally overcome. It will not go without a struggle, but the good times will come. It is important that we stay focused on the things that will happen when everyone goes back to work.

This article is about the latest developments regarding the Turkish Personal Data Protection Act. This Law has been in force for some time. The purpose of the Act is to set clear rules for administrators who process individual personal data. To get a clear picture of those who process individual personal data, the government requires them to register in a national registration system. The so-called VERBIS, which operates under the supervision of a Board.

VERBIS stands for 'Veri Sorumluları Sicil Bilgi Sistemi' in Turkish. This is a registration system where the personal data processing manager must register and clearly document how this sensitive information is processed. The administrator who processes personal data must report to the VERBIS registration system the following matters;

Identifying information (including the address of the data controller or its representative).
The purpose of the data processing,
The data subject groups and data categories (data processing inventory),
Recipient or recipient groups to which the data may be transferred
The data security measures taken to protect the processed data,
The maximum time for processing personal data (which must be in accordance with the purpose of the data processing).

The purpose of the registration system is to ensure that the data processing is carried out within the scope of the manager's transparency and accountability function, in order that involved parties can find the manager (or company or person) via the public system and if necessary, call them to account.

Below you can find a table with the latest registration dates regarding the registration obligation of administrators under the Turkish Personal Data Protection Act.

Make sure that your company is registered within the set deadline to avoid high administrative fines. The fine amounts start from 20.000,- TL.

Online registration is possible by: https://verbis.kvkk.gov.tr/DataResponsible/Register.

The English version of the Act is available on www.lawsturkey.com.

Processors	Start Date of Registration	Deadline for registration obligation
With 50 employees and more or a total balance sheet per year with more than 25 million Turkish Liras	01.10.2018	30.06.2020
Processors with offices abroad	01.10.2018	30.06.2020
With 50 employees or less and a total balance sheet per year with less than 25 million Turkish Liras, but certainly employed in personal data processing business activities	01.01.2019	30.09.2020
Processors of public authorities and organizations	01.04.2019	31.12.2020