The deadline for registration with data controllers’ registry has been extended due to COVID-19

Zihni BilgehanSenior Partner, Ersoy Bilgehan

This article is one of many articles we have published concerning the legal implications of Covid-19. Please click here for our “Covid-19 Insights” page and other articles.

The Data Protection Board (“Board”) has just announced that it has extended the deadline for registration with the Data Controllers’ Registry Information System (“VERBIS”) with its decision no. 2020/482.

The Board had previously extended the timeline for the following data controllers’ obligation to register with VERBIS to 30 June 2020 with its decision dated 27 December 2019:

  • The data controllers who employ more than 50 employees annually or whose active or passive assets exceed 25 million Turkish Liras, and
  • The real person or legal entity data controllers residing abroad.

Having established that many businesses were closed or adopted remote working as a measure against Covid-19 pandemic, the Board has extended the deadline for the above-mentioned data controllers for another three months, specifying the new deadline as 30 September 2020.

The Board has also resolved that:

  • The registration deadline for data controllers who do not meet the above thresholds but whose main area of activity is processing of special categories of personal data is extended to 31 March 2021, and
  • The registration deadline for public institutions is extended to 31 March 2021.

The obligation to register with the registry is one of the fundamental obligations of the data controllers under the Personal Data Protection Law, and non-compliance with this obligation may lead to administrative fines up to TRY 1,800,000.

While you may find further details of the registration obligations in one of our earlier articles here, please do not hesitate to contact our data protection team at [email protected] for any questions you may have regarding the matter.