Monetary Limit for Exemption from VERBIS Registration Obligation Has Been Increased

Monetary Limit for Exemption from VERBIS Registration Obligation Has Been Increased

The Personal Data Protection Board [“Board”], with its decision dated 06.07.2023 and numbered 2023/1154 published in the Official Gazette dated 25.07.2023 and numbered 32259, re-evaluated the amount of “total annual financial balance sheet” in line with the economic circumstances in Türkiye, which was accepted as a criterion for exemption from the obligation of registration with the Data Controllers Registry [“VERBIS”] pursuant to the Board’s dated 19.07.2018 and numbered 2018/87. As a result of this re-assessment, the total annual financial balance sheet of 25 million Turkish Liras for exemption from the VERBIS registration obligation was increased to 100 million Turkish Liras. It should be noted that the obligations of data controllers will not cease for the period in which they were registered with VERBIS even if they now fall within the scope of the exemption.

As a result of the relevant amendment, data controllers who are obliged to register with VERBIS are as follows:

• Real person and legal entity data controllers residing in Türkiye and having more than 50 employees or having a total annual balance sheet above TRY 100 million,
• Real person and legal entity data controllers residing abroad,
• Real person and legal entity data controllers whose main field of activity is processing sensitive personal data despite they have less than 50 employees and a total annual balance sheet below TRY 100 million, and
• Public institutions and organizations, and professional organizations having public institution status.

Pursuant to the Personal Data Protection Law No. 6698, administrative fines from TRY 119,428 to TRY 5,971,989 for the year 2023 may be imposed on the data controllers who fail to fulfil their VERBIS registration obligation. Therefore, we kindly remind data controllers who meet the above-mentioned criteria to fulfill their VERBIS registration obligation. In this scope, the Turkish Personal Data Protection Authority’s Guideline for Data Controllers Registry Information System can be reviewed here for detailed information on the registration process. [available in Turkish only].