In Emergency Situations
04 Feb, 2025

In this bulletin, we will examine the board decision regarding the amendment of the exemption criteria related to the registration obligation in the Data Controllers Registry, as per the Personal Data Protection Authority’s decision dated July 6, 2023, numbered 2023/1154.

Article 16 of the Personal Data Protection Law, under the supervision of the Board, stipulates that the Presidency shall maintain the Data Controllers Registry (“VERBIS”) publicly, and individuals and legal entities processing personal data must register in the Data Controllers Registry before starting the data processing activity.

The exceptions to this obligation are determined by the Board through its decisions, based on objective criteria such as the nature and number of processed personal data, the legal basis of data processing, or the transfer to third parties.

The Personal Data Protection Board, based on the 2nd paragraph of Article 16 of the Personal Data Protection Law No. 6698 and Articles 8 and 16 of the Regulation on the Data Controllers Registry, has amended the exemption criteria previously accepted in the Board’s decision numbered 2018/87, dated July 19, 2018. According to this decision:

  • In the Board decision dated July 2018 and numbered 2018/87, the phrase “real or legal person data controllers with fewer than 50 employees and an annual financial balance sheet total of less than 25 million Turkish Liras, whose main activity is not the processing of special categories of personal data,” the annual financial balance sheet total has been updated to **“real or legal person data controllers with fewer than 50 employees and an annual financial balance sheet total of less than 100 million Turkish Liras, whose main activity is not the processing of special categories of personal data.”**

With the new regulation effective from July 25, 2023, the exemption from the VERBIS registration obligation has been revised. The threshold for the annual financial balance sheet total, which was previously set at 25 million Turkish Liras, has now been increased to **100 million Turkish Liras**. Accordingly, **data controllers with fewer than 50 employees and an annual financial balance sheet total of less than 100 million Turkish Liras, whose main activity is not the processing of special categories of personal data**, are not subject to the VERBIS registration obligation.
This Board decision was published on the KVKK website and came into effect after being published in the Official Gazette No. 32259 on Tuesday, July 25, 2023.

Additionally, it is important to note that since the specified criterion is based on the annual financial balance sheet, if any of the company’s monthly balances exceed 100 million, the VERBIS registration obligation does not arise.

For any questions related to this matter, you can contact us using the information below.

Esenyel Partners | Board Decision Amending the Exception Criteria Regarding the Obligation to Register to the Data Controllers Registry by the Authority under the Personal Data Protection Law
Similar Articles