A series of decisions by the Data Protection Board (“DPB”) in relation to the obligation to register with the Data Controllers’ Registry (“Registry”) were recently published in the Official Gazette. The decisions set out new exemptions from registration obligations and provide the timeline for registration with the Registry.
New Exemptions from the Registration Obligations
As per the Turkish Personal “Data Protection Law” no. 6698, the DPB is authorised to determine exemptions by which certain data controllers can be kept exempt from the registration obligations. The DPB had previously declared the first exemptions in its decision numbered 2018/32 (all DPB decisions are only available in Turkish). The most recent decisions no. 2018/68, 2018/75 and 2018/87, which were published in the Official Gazette dated 18 August 2018, set out further exemptions as regards the registration obligations. Subsequent to these decisions, the data controllers who will be exempt from the obligation to register with the Registry are determined as the following:
- Data controllers who process data by non-automatic means which form part of a filing system;
- Associations, foundations, and trade unions which process personal data solely in relation to their own employees, members, and donors within the scope of their field of activities;
- Political parties;
- Public accountants and sworn-in public accountants;
- Customs brokers and authorized customs brokers;
- Natural and legal person data controllers who have less than 50 employees annually and less than 25,000,000 Turkish Liras (c. EUR 3,500,000) total annual balance, whose main processing activities do not involve processing of special categories of personal data.
Timeline for Registration Obligations
Although data controllers are required by law to register with the Registry, the registration obligations has not been due because the Data Protection Law required a separate announcement from the DPB, informing the data controllers that they are expected to register with the Registry within a specific time period. The DPB has finally made such announcement in its decision dated 2018/88 and determined the timeline for registration obligations as below:
|Data Controllers||Start date of the registration obligations||Prescribed period for registration||Deadline for registration|
|Natural and legal person data controllers who have more than 50 employees annually or more than 25,000,000 Turkish Liras (c. EUR 3,500,000) total annual balance||01.10.2018||12 months||30.09.2019|
|Natural and legal person data controllers residing abroad||01.10.2018||12 months||30.09.2019|
|Natural and legal person data controllers who have less than 50 employees annually or more than 25,000,000 Turkish Liras (c. EUR 3,500,000) total annual balance but whose main processing activities involve processing of special categories of personal data||01.01.2019||15 months||31.03.2020|
|Public institutions and organizations who are data controllers||01.04.2019||15 months||30.06.2020|
The obligation to register with the Registry is one of the fundamental obligations of the data controllers under the Data Protection Law, and non-compliance with this obligation may lead to administrative fines up to TRY 1,000,000 (c. EUR 130,000). While you may find further details of the registration obligations in one of our earlier articles here, please do not hesitate contact our data protection team at email@example.com for any questions you may have regarding the Data Protection Law.