Türkiye amends data protection exemption criteria for VERBIS registration
The Turkish Personal Data Protection Board ("Board") has recently amended the exemption criteria for registering with the Data Controller Registry ("VERBIS"). This decision, dated 6 July 2023 and numbered 2023/1154 ("Decision"), was published in the Official Gazette No. 32259 on 25 July 2023 and and introduced significant changes to the VERBIS registration requirements pursuant to Law No. 6698 on the Protection of Personal Data and the Regulation on the Registry of Data Controllers.
Regarding the background of this Decision, in response to the dynamic changes in the Turkish economy since 2018, the Board conducted a thorough review of the existing thresholds and decided to increase the annual financial balance sheet total limit for exemption from VERBIS registration. The previous threshold of TRY 25 million, set by the Board’s decision of 19 July 2018 (No. 2018/87), has now been revised to TRY 100 million.
As a result of the Decision, data controllers will be exempted from the obligation to register in VERBIS if: (i) their main field of activity does not involve the processing of sensitive personal data; or (ii) they have of less than fifty (50) employees per year and an annual financial balance sheet total less than TRY 100 million.
The main objective of this revision is to provide more appropriate and flexible regulations in line with the evolving business landscape while safeguarding personal data. For businesses operating in Türkiye, ensuring compliance with data protection laws and regulations is paramount. We urge all relevant data controllers to review their current registration status and assess whether they meet the updated exemption criteria.
For more information on data protection and its legal implications, please contact your CMS partner or local CMS experts: Dr. Döne Yalçın, Sinan Abra or İremgül Mansur.
