Open menu
22April2022

Administrative Sanctions Has Started Implementing by Turkish DPA for Data Controllers Who Are Not Registered VERBIS

Administrative Sanctions Has Started Implementing by Turkish DPA for Data Controllers Who Are Not Registered VERBIS

As it is known, Art. 16 of the Turkish Data Protection Law ("KVKK") numbered 6698 states that "Natural and legal persons who process personal data shall register with the Data Controllers Registry prior to the start of data processing" and with the provision "Data controllers are obliged to register Data Controllers’ Registry Information System ("VERBIS") within the period determined and announced by the Authority" provision is included.

Those are obliged to register with VERBIS listed below,

  • Natural and legal person data controllers whose employees more than 50 per year or whose annual financial balance sheet total is more than 25 million TRY,
  • Natural and legal person data controllers residing abroad,
  • Natural and legal person data controllers whose employees less than 50 per year or whose annual financial balance sheet total is less than 25 million TRY and whose main field of activity is processing sensitive personal data,
  • Data controllers of public institutions and organizations and professional organizations in the nature of public institutions.

they were given time to fulfill their obligation to register and notify until December 31, 2021.

Administrative sanctions may be imposed by the Turkish DPA on data controllers do not fulfill their obligation to register and notify with VERBİS in accordance with the "Those fail to meet the obligations for enrolling with the VERBIS and making a notification shall be required to pay an administrative fine of 20,000 to 1,000. 000 TRY." provision of the KVKK. The fines increase each year according to the revaluation rate, and this amount is determined as an administrative fine from 53,576 TRY to 2,678.866 TRY for 2022.

You can find our article on administrative fines to be applied in 2022 here.

In this context, administrative sanctions have been initiated against data controllers who are found to have not fulfilled their obligation to register and notify.

Should you have any queries or need further details, please contact your customer representative.

Written by Ece Nur Karakaş, Posted in Personal Data Protection Law

  • Notification!

    Contents provided in this article serve to informative purpose only. The article is confidential and property of CottGroup® and all of its affiliated legal entities. Quoting any of the contents without credit being given to the source is strictly prohibited. Regardless of having all the precautions and importance put in the preparation of this article, CottGroup® and its member companies cannot be held liable of the application or interpretation of the information provided. It is strictly advised to consult a professional for the application of the above-mentioned subject.

    Please consult your client representative if you are a customer of CottGroup® or consult a relevant party or an expert prior to taking any action in regards to the above content.

About The Author

Ece Nur Karakaş

Legal Consultant - Attorney
This website is using cookies.
In this website, we use cookies to develop your user experience, obtain efficient work and track statistical data. You are agreeing to our use of cookies by browsing our website. Please review Çerezler (Cookies) page for detailed information of how we manage the cookies. This choice is valid for 30 days until you delete the cookies in your web browser.
x