New Criteria Set Forth for VERBIS Registration by Turkey’s Data Protection Authority
As per the decision dated July 19, 2018 and numbered 2018/87 of the Turkey’s Data Protection Authority (“Authority”) (“Decision No.2018/87”)[i], all data controllers who process data in automatic or semi-automatic ways and (i) employ more than 50 employees in a year, or (ii) whose total annual balance is more than 25 million Turkish Liras are required to register with VERBİS.
As briefed within our Legal Alert dated December 30,2019, the Authority has extended the deadline for the registration with the Data Controllers’ Registry System (“VERBIS”) for certain data controllers on December 17, 2019 with a decision numbered 2019/387 (“Decision No.2019/387”)[ii].
With the Decision No.2019/387, the deadline for VERBIS registration is extended to;
(i) June 30, 2020 for the data controllers whose number of annual employees exceeds 50 or whose annual financial balance sum exceeds TRY 25,000,000 and for the data controllers who are resident/established abroad,
(ii) September 30, 2020 for the data controllers whose number of annual employees is less than 50 and whose annual financial balance sum does not exceed TRY 25,000,000 but whose main business activity concerns the processing of special categories of personal data,
(iii) December 31, 2020 for the data controllers who are public entities or public institutions.
As Decision No.2019/387 relieved data controllers who had not yet completed their compliance projects, it also caused uncertainty regarding the calculation method of the annual number of employees and the total annual balance in order to determine whether data controllers are obligated to register with VERBIS. Within this article, it is aimed to clarify the application of such calculation methods for the year 2020^with respect to the Decision No. 2018/87.
Calculating the annual number of employees:
As per the Q&A Guide regarding VERBIS published by the Authority (“Q&A Guide”)[iii], in order to calculate the annual number of employees, (i) a one-year period must be completed and (ii) the number of employees stated in the Tax and Premium Service Statement which data controllers must monthly provide to the authorized public institutions and organizations in at least seven months out of the twelve months of said one-year period must be considered.
Accordingly, the one-year period is exemplified in the Q&A Guide as a calendar year (which begins on January 1st and ends on December 31st of the same year). The abovementioned seven months are not required to be consecutive as long as the relevant seven months are within the same year.
Consequently, if the data controller declared 50 or more employees in the Tax and Premium Service Statement provided to the authorized public institutions and organizations in at least seven months out of twelve months between January 1,2019 and December 31,2019, then the data controller would be obligated to register with VERBIS as per the Decision No.2018/87.
Calculating the total annual balance:
Pursuant to the Q&A Guide, in order to calculate the total annual balance (i) a one-year period must be completed and (ii) the total stated in the “active” or “passive” section, which shall be the same amount, in the annexed balance sheet to the annual revenue or corporate tax return statement that data controllers provide to the authorized public institution within that completed year shall be considered. Accordingly, when calculating the total annual balance, information regarding turnover or net/gross sales revenue shall not be considered.
Consequently, if the total annual balance exceeds 25 million Turkish Liras, the data controller would be obligated to register with VERBIS.
With the Circular regarding Tax Procedure Law dated March 29,2019 and numbered 115 issued by the Revenue Administration (“Circular”)[iv], the deadline for declaration of annual revenue and corporate tax return statements (along with other statements) have been extended:
(i) The deadline for declaration of annual revenue tax return statement have been extended to the last day of March of the following year, and
(ii) The deadline for declaration of corporate tax return statement have been extended to the last day of April of the following year.
(iii) In addition, the deadlines for the taxpayers who have special accounting periods have been extended to the last day of payment.
Considering the above explanations, as calculation of the total annual balance for the year 2019 would only be possible after the declaration of annual revenue or corporate tax return, data controllers would not be able to determine whether they fulfil the criteria regarding total annual balance until then.
In conclusion, for the first few months of 2020, in order to determine whether they are obligated to register with VERBIS, the data controllers shall initially evaluate whether the first criteria regarding annual number of employees is met:
(i) If in terms of the annual number of employees which shall be calculated as explained above, registration with VERBIS is obligatory for the data controller, then registration shall be completed before the deadline applicable to the data controller.
(ii) If registration with VERBIS is not obligatory for the data controller in terms of the annual number of employees, then the data controller shall re-evaluate in accordance with the annexed balance sheet to the annual revenue or corporate tax return statement once it is prepared as of March/April 2020. If in terms of the total annual balance which shall be calculated as explained above, registration with VERBIS is obligatory for the data controller, then registration shall be completed before the deadline applicable to the data controller.
[i] https://www.kvkk.gov.tr/Icerik/5271/2018-87
[ii]https://www.kvkk.gov.tr/Icerik/6631/Veri-Sorumlulari-Siciline-Kayit-Yukumlulugune-Iliskin-Kurulca-Belirlenen-Tarihler-Hakkinda-2019-387-Sayili-Kurul-Karar-Ozeti
[iii]https://www.kvkk.gov.tr/SharedFolderServer/CMSFiles/09c01e90-167b-435c-b200-ce25ef9c1020.pdf
[iv]https://www.gib.gov.tr/1-nisan-2019-tarihinden-itibaren-verilmesi-gereken-bazi-vergi-beyannamelerinin-verilme-surelerinin
Author: Simge Kılıç