Within the scope of the Law no. 6698 on the Personal Data Protection (“Law”), data controllers who meet the criteria determined by the Personal Data Protection Board (“Board”) are obliged to register and notify in the system called Data Controllers Registry Information System (“VERBIS”).
It is announced that VERBIS registry must be completed within the period of time given to data controllers who meet the criteria after the electronic infrastructure has been ready for VERBIS in 2018. For more detailed information on registration to VERBIS, you can access the article titled “VERBIS Registration Period” on our website here.
Has The Registration Period for VERBIS Expired?
The registration periods to VERBIS have been extended by the Board due to the inability to fully understand the system and requests from the Union of Chambers and Commodity Exchanges of Turkey and other sector representatives. In the meantime, the data controllers who do not fulfil their VERBIS registration obligation have been warned in writing by the Board to register with VERBIS. However, no administrative fines were imposed on data controllers who did not fulfil their VERBIS registration obligation in any way.
Lastly, due to the Covid-19 pandemic, the registration periods had been extended to 31 December 2021 for all data controllers meeting the criteria, and this was the last time extension made by the Board. In the public announcement published by the Board on April 21, 2022, it was reported that administrative fines have been started to imposed against data controllers who were detected to had not fulfilled their obligation to register with VERBIS in accordance with the Law.
What Awaits Data Controllers Who Do Not Register With VERBIS?
In accordance with the regulations on administrative fines in the Article 18 of the Law, it is regulated that data controllers who do not fulfil their VERBIS registration obligation shall be fined from 53,572 Turkish liras to 2,678,863 Turkish liras, according to the increase of the revaluation rates, in 2022.
In case the data controllers who do not fulfil the obligation to register with VERBIS are public institutions and organizations and professional organizations in the nature of public institutions, upon the notification to be made by the Board, actions are taken against civil servants in accordance with disciplinary provisions who are working in the relevant public institution and organization and other public officials and professional organizations in the nature of a public institution.
Who Must Register With VERBIS?
In determining the data controllers who are responsible for registering with VERBIS, the annual number of employees, annual financial balance sheet and whether the subject of activity is special category of personal data processing have been checked. In case you meet the criteria in the table below, we recommend that you take action on your VERBIS registration by contacting your legal consultants.
| For the natural and legal person data controllers and the natural and legal person data controllers abroad, whose annual number of employees is more than 50 or the annual financial balance sheet total more than 25 million TL | For the natural and legal person data controllers whose main field of activity is processing of sensitive personal data and whose annual number of employees is less than 50 or the annual financial balance sheet total less than 25 million TL | Public institutions and organizations |
Attorney Ezginaz Çalışır
