Pursuant to the LPPD and the Regulation on the Registry of Data Controllers, data controllers are required to enroll in the Registry of Data Controllers before proceeding with data processing.

The Regulation on the Registry of Data Controllers was published in the Official Gazette dated December 30, 2017, and entered into force on January 1, 2018. It regulates the establishment of a publicly accessible registry, which is to be held by the Personal Data Protection Authority and the procedures and principles concerning enrollment in the registry.

Under this Regulation, all data controllers are required to enroll in the Registry of Data Controllers before proceeding with data processing. However, the Personal Data Protection Board may bring an exception to the obligation of enrollment by taking into account the nature and number of personal data, purpose of processing personal data, and other objective criteria. Data controllers are not required to enroll in the Registry of Data Controllers in the following circumstances:

• The processing of personal data is required for criminal investigation or for prevention of a criminal offense;
• If the personal data being processed is already publicized by the data subject;
• If, based on the authority given by Law, personal data processing is required for disciplinary investigation or prosecution and execution of the supervision or regulation duties to be conducted by public institutions and organizations and professional organizations with public institution status; or
• If processing of personal data is required to protect the economic and financial interests of the State in relation to budget, tax and financial matters.

Over the past year, the Personal Data Protection Board has enumerated additional exceptions to enrollment obligation:

• Data controllers who process personal data by non-automatic means as a part of a filing system, lawyers, independent accountants and financial advisors;
• Natural or legal persons having less than 50 employees per annum and annual balance less than TRY 100 million and whose main field of activity is not processing special categories of personal data.

Data controllers who are non-resident in Turkey shall enroll in the registry through a representative they assign in Turkey. Legal persons in Turkey or Turkish citizens may be assigned as representatives for this purpose.

In addition, both legal entities resident in Turkey and the above-mentioned representatives of non-resident data controllers shall, as part of the enrollment procedure, appoint an individual to act as “contact person” for both the Personal Data Protection Authority and for data subjects.

Operations related to the Registry of Data Controllers shall be carried out through VERBIS (Data Controllers Registry Information System) by data controllers. The Personal Data Protection Authority, with its decision dated March 11, 2021, numbered 2021/238, had extended the dates for the registration through VERBIS until December 31, 2021.

Although the deadline has passed, it is still possible for local and foreign data controllers to register with VERBIS if the obligation arises or if the controller failed to register in time.

On August 15, 2022, the Data Protection Authority has started enforcement against foreign controllers that did not register within the deadline. Within the context of such enforcement the Data Protection Authority sent out letters to foreign controllers to request information as to reasons why the registration was not completed together with information on the number of users and global turnover to calculate the administrative fine.

Administrative fines of between TRY 272.380 – TRY 13.620.402 (approx. € 7,420 - € 370,900) may be imposed on data controllers breaching obligations regarding the Registry of Data Controllers.

Further, the DPA has the right to restrict the data processing activities of a data controller in cases of clear unlawfulness operation by a data controller and in theory, processing personal data without registering with the Registry of Data Controllers may lead to such restriction.