Turkey Extends Deadline for the Registration of Data Controllers

Board Decision No. 2020/482 of the Personal Data Protection Authority further extends the deadline by which data controllers must register with the Authority in Turkey due to COVID-19. 

This Decision extends the implementation of this requirement superseding the deadlines provided in Decision No. 2019/387. 

Pursuant to Article 16(2) of the Data Protection Law No. 6698, data controllers are required to register with VERBIS, the Register of Data Controllers Information System, prior to the processing of personal data.

According to the Decision, the following parties are required to register prior to 30 September 2020:

• Natural and legal person data controllers that have over 50 employees annually or a financial statement of over 25,000,000 TL annually
• Natural and legal person data controllers resident abroad

Additionally, the following parties are required to register prior to 31 March 2021:

• Natural and legal person data controllers that have below 50 employees annually or a financial statement less than 25,000,000 TL annually and whose main activity is to process sensitive personal data
• Public institutions and organizations

This Decision entered into force on 25 June 2020.