KVKK

The Personal Data Protection Board announced that the deadline for registration in the Data Controllers Registry Information System ("VERBIS") has been extended with its decision numbered 2019/387, published on 27.12.2019. In its decision regarding the extension, the Board

• In order to fulfill the registration and notification obligation within the time stipulated by the data controllers, intense applications and notifications have been sent via VERBIS in recent days; however, the obligation to register and notify the aforementioned notifications in the Registry is contrary to the objectives and principles of transparency, accurate and complete registration and accountability;
• There are serious mistakes in the content of the random notifications made in order to register on time in the last days, violations of the Law and other relevant legislation;
• While VERBIS is fulfilling its registration and notification obligation, it is necessary to prepare Personal Data Processing Inventory, which includes all business processes, and this inventory should be taken as a basis;
• Submitting the registration application form alone does not mean notification obligation and it is necessary to complete the notification regarding personal data processing activities by logging into VERBIS

based on its reasons, VERBIS decided to set the deadlines for the registration obligation as follows:

Do you have an obligation to register with VERBIS?
Real and legal person data controllers with an annual number of employees of 50 or more or annual financial balance sheet totaling more than 25 million TL are required to register with VERBIS.

In calculating the annual number of employees, it is essential to have a completed year first; At this point, when calculating, 2019 should be taken into account for the VERBIS registration obligation to be realized in 2020. Afterwards, it is necessary to take into account the number of employees reported in the Concise and Premium Service Declaration, which is given monthly by the data controller to authorized public institutions and organizations in at least 7 months out of 12 months in a completed year. In addition, the 7 months in question do not have to be consecutive, provided that they are within the same year. In other words, if the number of employees is more than 50 for a total of 7 months in a calendar year, the data controller has VERBIS registration obligation.

The criterion for the annual financial balance sheet total to be more than 25 million TL, stipulated in terms of VERBIS registration obligation, is often compared with the annual turnover. The annual financial balance sheet total represents the sum of the asset and liability statements in the balance sheet, that is, all assets and liabilities of the company, regardless of whether they were traded in that balance sheet year. Data controllers should evaluate accordingly whether they meet the 25 million TL criterion in terms of VERBIS registration obligation. At this point, for the VERBIS records to be made in 2020, the 2019 fiscal year records should be taken as a basis in terms of the annual financial balance sheet total.
Finally, natural and legal person data controllers residing abroad are also obliged to register with VERBIS, regardless of the number of employees and annual balance sheet criteria.

You can find the full text of the relevant decision at the link below: https://www.kvkk.gov.tr/Icerik/6631/Veri-Sorumlulari-Siciline-Kayit-Yukumlulugune-Iliskin-Kurulca-Belirlenen-Tarihler-Hakkinda-2019-387-Sayili-Kurul-Karar-Ozeti