20September2019

Obligation and Conditions of Resident Responsibilities for Abroad to VERBIS

Obligation and Conditions of Resident Responsibilities for Abroad to VERBIS

In the event that some or all of the personal data is transferred to the founder / partner foreign company located abroad and the foreign company uses this data for its own purposes, there is an obligation to register with the Data Responsible Register Information System (“VERBİS”). These transfers, in general, consist of recordings of all or part of the data of the employees, suppliers and customers of the legal entity in Turkey to a registration system which is provided and managed by foreign partner. However, keeping only personal data in a registration system by the foreign partner does not constitute VERBIS registration obligation and the foreign partner should use this data for their own purposes.

In accordance with this explanation; the legal entity resident abroad or with a partner company's founder identity in Turkey has to register at Data Controllers’ Registry (hereinafter referred to as “VERBİS”) by means of a Data Controller Representative; and the legal entity based in Turkey acting as data controller has to register at VERBİS, if they meet the requirements below are met.

We share the related sections of the relevant legislation, decisions and guidelines below:

According to the Article 5 of Regulation on VERBIS,

Procedures and Principles

(b) Data controllers non-resident in Turkey, are obliged to register at VERBİS by means of a data controller representative before processing any data.

According to the Article 11 of Regulation on VERBİS,

Obligations of the data controller, data controller representative and the contact person

(2) Certified copies of the decision to be taken by the authorized body or person regarding to the appointment of data controller representative of the data controller who is non-resident in Turkey, are submitted to the Board by the data controller representative during VERBİS registration.

Personal Data Protection Board Decision dated 03/09/2019 and numbered 2019/265

With the Board's decision numbered 2019/265, the deadline for registration is defined as 31.12.2019, for real person / legal entities based abroad.

According to the Article 3 of the European Union Data Protection Regulation (GDPR)

(2) The law also applies to the processing of the personal data of the data holders in the EU by a controller or processor that is not established in the EU, as well.

(Here, depending on the reciprocity principle; KVKK also applies, if data controllers process data, who are non-resident in Turkey. Accordingly, data controllers based abroad, must register at VERBIS.)

DECISION OF APPOINTMENT

(appointment letter)

With the Article 11 of the Regulation on VERBİS, how to make decision of appointment and the procedures and principles are described. According to this;

1. Certified (Turkish translated and notarized) copy of the decision to be taken by the authorized body or person regarding to the appointment of data controller representative who is non-resident in Turkey, are submitted to the Board by the data controller representative during VERBIS registration.

(Data controller resident abroad, must send the decision with wet signature including apostille or notary approval to the Board via regular mail, which is to be taken as described below, before registering at VERBİS. The Board, either approves or rejects the application sent through Registered Electronic Mail (hereinafter referred to as "KEP"), after also evaluating the decision of appointment.)

2. The decision to appoint a data controller representative shall be arranged to cover at least the following points:

  • a) Notification or acceptance of notifications or correspondence made by the Board on behalf of the data controller,
  • b) Forwarding the requests of the Board directed to the data controller to the data controller and forwarding the response of the data controller to the Board,
  • c) In case, no other basis has been determined by the Board; receiving applications of the relevant persons on behalf of the data controller and forwarding them to the data controller, in accordance with the first paragraph of the Article 13,
  • ç) In case, no other basis has been determined by the Board; forwarding the response of the data controller to the relevant persons, in accordance with the third paragraph of the Article 13,
  • d) Carrying out the works and transactions related to the VERBİS on behalf of the data controller.

RESULT:

1. As stated in the related regulation on VERBIS registration and decision numbered 2019/265; data controllers based abroad must register anyway; and data controllers based in the country must register at VERBİS by 31.12.2019, if the annual number of employees is more than 50 or the total of annual financial balance sheet is more than 25 million TL.

If there is a partner or founder of a resident data controller who is also resident legal entity abroad and if this legal entity based in abroad is using this personal data which was transferred to him from Turkey for its own purposes, resident data controller and non-resident data controller are obliged to register at VERBIS separately.

2. If your company has a data processing activity as mentioned above by the partner or founder of the company located abroad, it is required to take a decision to appoint a data controller representative and to complete the VERBIS registration process by 31.12.2019 sharing this decision with the Board.

The said resident data controller abroad may appoint your company, another legal or real person as representative.

3. It's crucial to note that, the failure to fulfill its obligations of Personal Data Protection Law (KVKK) and other legislation for this legal entity based abroad. The sanctions in this respect shall be directed to the legal entity based abroad. The founder or partner of the company in Turkey will not bear responsibility.

Written by Şeyma Nur Kaplan, Posted in Personal Data Protection Law

  • Notification !

    Contents provided on this article serve to informative purpose only. The article is confidential and property of CottGroup® and all of its affiliated legal entities. Quoting any of the contents of this notification without credit being given to the source is strictly prohibited. Regardless of having all the precautions and importance is put in the preparation of this article, CottGroup® and member companies cannot be held liable of the application or interpretation of the information provided. It is strictly advised to consult a professional for the application of the above-mentioned subject. Prior to taking any action in regards the above, please consult your client representative if you are a customer of CottGroup® or consult to a relevant party.

About the Author

Şeyma Nur Kaplan

Legal Consultant Attorney
This website is using cookies.
In this website, we use cookies to develop your user experience, obtain efficient work and track statistical data. You are agreeing to our use of cookies by browsing our website. Please review Çerezler (Cookies) page for detailed information of how we manage the cookies. This choice is valid for 30 days until you delete the cookies in your web browser.
x