Board Decision No. 2019/225 on the Obligation of Branch and Liaison Offices to Register for VERBIS Has Been Published

Due to the activities on personal data processing in Türkiye, legal persons which are located abroad;

Legal persons residing abroad,

The branches of legal persons residing abroad,

The liaison offices of legal persons residing abroad

the Turkish Data Protection Board announced a decision no: 2019/225 (“Decision”) in regards with the personal data protection Law numbered 6698, as a result of the examination whether these entities are to be considered as data officers and whether there is an obligation for these entities to submit a record to the Data Responsible Register (“Registry”).

Decision of the Board, with regard to whether legal persons resident abroad, Türkiye branches of the legal persons resident abroad and Türkiye liasion offices will be considered as data controller according to KVKK or not and whether they will make a record submission to the registry or not, as follows:

From the aspect of the branches incorporated in Türkiye, of legal persons resident abroad;

The Board primarily of commercial enterprises operating abroad, to open a branch in Türkiye in terms of conducting business relations and to establish a liaison office that there are two options; stated that as the scope of the activities of the companies expanded in practice, the works were carried out through branches. In this context, the Board referred to the definitions of “branch” particularly in TTK and other different laws and regulations, in its decision and stated each of them one by one that; “in order to be considered as a branch, it is necessary to look at criterias such as being dependent to the center, independence in external relations, separation of place and management”;

Being dependent to the HQ (center office); the branch and the headquarters should be connected to the same real or legal person; it is stated that the rights obtained through the branch are the head offices’ rights and depts are the head offices’ debts, not the branch’s;

Independence in external relations; the branch is authorized to carry out transactions like the head office such as those carried out by the headquarter with third parties;

Separation of place; the branch should have a different location from the headquarter since it is authorized to conduct commercial transactions alone;

Separation of management; the branch should have a separate management from the headquarter since it is authorized to conduct commercial transactions alone.

That being said, the issue was also addressed in the Decision in terms of GDPR and the concept of “enterprise” was emphasized by referring to Articles 3 and 4 of GDPR These provisions and Art. 40 of the TTK which regulates that branches are registered as domestic commercial enterprises was interpreted together; according to the GDPR, the criteria for being a data controller does not include the requirement to be a legal person and the branches that meet the above-mentioned requirements will be deemed as data controller; in this context, it has been decided to make a declaration to the Registry.

In terms of the liaison offices of legal persons resident abroad in Türkiye;

Referring to the Foreign Direct Investment (FDI) Law numbered 4875, liaison offices can be established in the country of direct investment and it will be possible to establish these liasion offices on the condition that shall not engage in commercial activities; they will not be deemed as a data controller due to the fact that they are established for information purposes other than commercial activities and the branch company does not have branch characteristics; in this context, it is decided that it is not obligatory to submit a record to the Registry.

In conclusion;

Legal persons resident abroad are obliged to submit a record to the Registry if they engage in personal data processing activity directly or via branches in Türkiye,

Branches will be deemed as a data controller residing in Türkiye and they are obliged to submit a record to the Registry if their annual number of employes is over 50 or their annual financial balance sheet total is over 25 million TL,

Due to the purposes of liaison offices in Türkiye such as, only non-commercial activities in Türkiye and to inform the headquarter, they are not obliged to submit records to the Registry.