Verbis Registration Deadline is Approaching Quickly!

As you may recall, the Data Protection Board extended the registration period to 31.12.2021 with its Decision No.2021/238 dated 11/03/2021 due to the requests submitted to the Personal Data Protection Authority (“Authority”) for the extension of the registration periods to the Registry, on the grounds that there are difficulties in duly fulfilling the obligation to register in the Data Controllers’ Registry Information System (VERBIS) due to the Covid-19 virus epidemic.

In this context, Data Controllers who must fulfil their registration obligation until 31.12.2021 are as follows;

  • Real and legal person data controllers with more than 50 employees or with annual financial balance of more than 25 million TL and real and legal person data controllers residing abroad

  • Real and legal person data controllers, whose number of employees is less than 50 and whose annual financial balance is less than 25 million TL, and whose main field of activity is the processing of special quality personal data

  • Data controllers of public institutions and organizations and professional organizations in the nature of public institutions

Therefore, data controllers who have not yet registered with the registry must register with the Data Controllers Registry until 31.12.2021, and appoint a contact person and enter information through these contact persons. This information, which Data Controllers will enter through their contact persons, are the issues that must be included in the Personal Data Processing Inventory, which was defined in the Regulation on the Data Controllers Registry published in the Official Gazette on 30.12.2017. Accordingly, the data controllers are required to record on the Registry screen; the personal data processing activities carried out in connection with business processes, the personal data processing purposes and legal reason, the data category, the transferred recipient group, and the maximum storage period required for the purposes for which the personal data is processed, the personal data they are intended to be transferred to foreign countries, and the measures taken regarding data security.

At this stage, it should be noted that in case of violation of the obligation to register and notify VERBIS, an administrative fine of 39,337 TL (lower limit) -1,966 .862 TL (upper limit) may be imposed in accordance with the revaluation rate for 2021 on administrative fines included in Article 18 of the Personal Data Protection Law (“Law”).

Therefore, it is of great importance for Data Controllers that this notification is made accurately and completely, and if the notifications are made incorrectly or incompletely, an administrative fine may be imposed because the obligation is deemed not to be fulfilled.

In addition, those who are obliged to register with VERBIS are also required to fulfil their other obligations (clarification, express consent, administrative and technical measures, responding to the data subject, complying with KVKK decisions, etc.) as required by the Law.