The Turkish Data Protection Authority ("Turkish DPA") announced on its website on 27 December 2019 that the deadline for registration on the Register of Data Controllers ("VERBIS") has been extended through 30 June 2020.
The Turkish DPA's Board resolved in its decision numbered 2019/387 to postpone the deadline for VERBIS registration until 30 June 2020 for (i) natural or legal person data controllers whose number of employees exceeds 50 or whose annual balance sheet total (total assets on the balance sheet) exceeds TRY 25 million and (ii) natural or legal person data controllers that are resident outside of Turkey. Although the awareness on the VERBIS registration requirement is noticeably low outside of Turkey, foreign data controllers are indeed required to register their data processing activities on VERBIS.
The deadline for VERBIS registration was extended through 30 September 2020 for data controllers whose main area of activity is processing special categories of personal data, even if they have fewer than 50 employees and their annual balance sheet value is under TRY 25 million. Finally, the deadline for public-institution data controllers was extended through 31 December 2020.
As explained in previous alerts, the Turkish Data Protection Law requires data controllers to register their data processing activities on VERBIS. The Turkish DPA launched the registration process in October 2018 and initially set the deadline for registration as 30 September 2019, but later extended it through 31 December 2019.
With this extension, data controllers who have not yet completed the necessary steps towards registering on VERBIS will have additional time to ensure compliance.
