INFORMATION NOTE REGARDING THE DECISION OF THE PERSONAL DATA PROTECTION BOARD ON THE TIME EXTENSION FOR REGISTERING WITH VERBIS
27 December 2019
The decision of the Personal Data Protection Board (“Board”) numbered 2019/387 concerning “The Time Extension for Registering with Data Controllers’ Registry Information System (“VERBIS”)” (“Decision“) is published on the official website1 of the Personal Data Protection Authority earlier today announcing that the deadline for registering with VERBIS is extended.
According to the Decision, the deadline for the data controllers to fulfil their obligations of notification and registering with VERBIS is extended until the dates provided below:
The Decision also focuses on the motivation of such time extension and draws attention on the purpose of the Personal Data Protection Law numbered 6698 (“Law”) and the requirements in fulfilling the notification and registration obligation, upon the detection of deficiencies in the registrations made by data controllers.
In this respect, the Board reminds data controllers the following:
- There are two obligations set forth under Article 16 of the Law: The first one is registering with VERBIS and the second one is completing the notification regarding the processing of data.
- Primary objective of the registration and notification obligation is to provide transparency in processing personal data, disciplining the operations regarding processing of personal data as well as creating a culture on the matter and raising awareness in the society.
- The obligation of notification and registration with VERBIS should not only be understood as registering with VERBIS on time but also the information provided to VERBIS must be true, up to date and trustworthy covering all personal data processing activities.
- There should not be any discrepancy in terms of processing of personal data, receivers/receiver groups, data subjects, technical and administrative measures, adequate prevention, transferring data to abroad and retention period.
- Data controllers must have an inventory of personal data that they process in accordance with the Regulation on Data Controllers Registry and registration with VERBIS must be performed based on the information provided in such inventory.
- In case of change on the information provided to VERBIS the Personal Data Protection Authority must be notified in 7 (seven) days from the date of such change.
Should you have any queries on the above, please do not hesitate to contact us.