The Turkish Data Protection Authority postponed the deadline for registration to VERBIS (Data Controllers’ Registry) w. its decision no 2019/265.
The deadline, which was 30.09.2019, is moved to 31.12.2019. This postponement is a very good chance for all data controllers to finalize their compliance preparations and register with the VERBIS.
Here is a recap on VERBIS;
1- Is My Organization Required to Register?
Yes, if;
a) your organization is a data controller located out of Turkey but collects and processes personal data or
b) if your organization is a data controller located in Turkey with 50 or more employees and an annual turnover of more than try 25.000.000, or
c) if your organization is data controller in Turkey with the core business of processing sensitive personal data (i.e.. Hospitals, doctors etc.) *(certain exemptions apply i.e. attorneys, notary publics etc. are not required to register regardless of the turnover and employee number)
Further, if your organization is a data controller located abroad and your organization has a subsidiary in Turkey (which is another data controller), your organization will still need to register with the Verbis. Therefore, this would mean two registrations, one for your organization and one for the subsidiary in Turkey
2- What Steps My Organization Should Take If I Believe My Organization Is Required to Register?
First step should be to prepare/update your personal data inventory. Your personal data inventory will be the basis and source for the entry to the Verbis.
If your organization is a data controller located out of Turkey, you must first duly appoint a Turkish Real Person or Legal Person as Data Controller Representative. Only after appointing a Data Controller Representative, the Data Controller Representative can start the entry on behalf of your organization.
After this, you must appoint a Turkish citizen as contact person on Verbis.
If your organization is a data controller located in Turkey, you can personally start and finalize the entry on behalf of your organization and it is not required to appoint a Data Controller Representative however you must appoint a Turkish citizen as a contact person on Verbis.
3- How Long Does It Take to Register?
Verbis uses a drop-down interface to enter data about the category of personal data, data subject, retention time, legal grounds for processing, purpose etc.
Therefore, if you have a readily available Personal Data Inventory, the registration can be finalized within hours. If not, please prepare your Personal Data Inventory as soon as possible.
4- How Can You Help My Organization?
We act as your Data Controller Representative and Contact Person in Turkey. Further, we prepare/update personal data inventories for our clients and make the registration on behalf of our clients.
Comments