7 April 2023
As you may know, the data controllers who meet the following criteria are obliged to register with Data Controllers’ Registry Information System (“VERBIS”):
Turkish entities/real persons who employ more than 50 employees in a year or whose total balance of annual financial statement is more than 25 million Turkish Lira.
Turkish entities/real persons with less than 50 employees annually or with an annual financial balance of less than TRY 25 million, whose activity is processing special categories of personal data.
Non-Turkish entities/real persons established in another jurisdiction.
The deadline for registration with VERBIS for the abovementioned data controllers expired on 31.12.2021. However, we would like to remind you that each year, following the issuance of their annual financials, the data controllers are obliged to re-evaluate whether they exceed the thresholds above and they need to be registered with VERBIS. Therefore, if your Turkish entity had more than 50 employees in 2022, or the balance of the entity’s total annual financial statement is more than TRY 25 million, it would be advisable to re-evaluate your entity’s VERBIS registration status.
Furthermore, if you are operating an entity residing outside Turkey and such an entity qualified as a data controller according to the Turkish Personal Data Protection Law No.6698, in other words, if the entity determines the purpose and means of processing personal data of the data subjects residing in Turkey, such an entity must be registered with VERBIS. It should be noted that the thresholds above (i.e. falling under 50 employees and TRY 25 million turnovers) are not applicable for the entities residing abroad and such data controllers are obliged to register with VERBIS in any case.
As a side but important note, while calculating the number of employees and turnover, the following should be taken into account:
As known, each employer has to notify the Social Security Institution of the number of employees together with the information on the salaries on a monthly basis. If seven (7) notifications out of twelve (12) within a year contain more than 50 employees, the data controller shall be considered as it has more than 50 employees.
Also, while calculating the total annual revenue of the data controller, the financial statements which were attached to the annual corporate income tax return shall be taken into the account.
Should you have any queries on the above, please do not hesitate to contact us.
Best Regards,
Güner Law Office