Open menu
20September2019

VERBIS Registration Obligation and Conditions for the Data Controllers Resident Abroad

VERBIS Registration Obligation and Conditions for the Data Controllers Resident Abroad

The publication below may be out of date due to postponements and recent announcements. Please click here to access the current deadlines for VERBIS registration obligation mentioned in the publication.

In the event that some or all of the personal data is transferred to the founder / partner foreign company located abroad and the foreign company uses this data for its own purposes, there is an obligation to register with the Data Controller’s Registry Information System (“VERBIS”). These transfers, in general, consist of recordings of all or part of the data of the employees, suppliers and customers of the legal entity in Türkiye to a registration system which is provided and managed by foreign partner. However, keeping only personal data in a registration system by the foreign partner does not constitute VERBIS registration obligation and the foreign partner should use this data for their own purposes.

In accordance with this explanation; the legal entity resident abroad or with a partner company's founder identity in Türkiye has to register with Data Controllers’ Registry (hereinafter referred to as “VERBIS”) by means of a Data Controller Representative; and the legal entity based in Türkiye acting as data controller has to register with VERBIS, if they meet the requirements below are met.

We share the related sections of the relevant legislation, decisions and guidelines below:

According to the Article 5 of Regulation on VERBIS,

Procedures and Principles

(b) Data controllers non-resident in Türkiye, are obliged to register with VERBIS by means of a data controller representative before processing any data.

According to the Article 11 of Regulation on VERBIS,

Obligations of the data controller, data controller representative and the contact person

(2) Certified copies of the decision to be taken by the authorized body or person regarding to the appointment of data controller representative of the data controller who is non-resident in Türkiye, are submitted to the Board by the data controller representative during VERBIS registration.

Personal Data Protection Board Decision dated 03/09/2019 and numbered 2019/265

With the Board's decision numbered 2019/265, the deadline for registration is defined as 31.12.2019, for natural person / legal entities based abroad.

According to the Article 3 of the European Union Data Protection Regulation (GDPR)

(2) The law also applies to the processing of the personal data of the data subjects in the EU by a controller or processor that is not established in the EU, as well.

(Here, depending on the reciprocity principle; KVKK also applies, if data controllers process data, who are non-resident in Türkiye. Accordingly, data controllers based abroad, must register with VERBIS.)

DECISION OF APPOINTMENT

(Appointment Letter)

With the Article 11 of the Regulation on VERBIS, how to make decision of appointment and the procedures and principles are described. According to this;

1. Certified (Turkish translated and notarized) copy of the decision to be taken by the authorized body or person regarding to the appointment of data controller representative who is non-resident in Türkiye, are submitted to the Board by the data controller representative during VERBIS registration.

(Data controller resident abroad, must send the decision with wet signature including apostille or notary approval to the Board via regular mail, which is to be taken as described below, before registering with VERBIS. The Board, either approves or rejects the application sent through Registered Electronic Mail (hereinafter referred to as "KEP"), after also evaluating the decision of appointment.)

2. The decision to appoint a data controller representative shall be arranged to cover at least the following points:

  • a) Notification or acceptance of notifications or correspondence made by the Authority on behalf of the data controller,
  • b) Forwarding the requests of the Authority directed to the data controller to the data controller and forwarding the response of the data controller to the Authority,
  • c) In case, no other basis has been determined by the Board; receiving applications of the relevant persons on behalf of the data controller and forwarding them to the data controller, in accordance with the first paragraph of the Article 13,
  • ç) In case, no other basis has been determined by the Board; forwarding the response of the data controller to the relevant persons, in accordance with the third paragraph of the Article 13,
  • d) Carrying out the works and transactions related to the VERBIS on behalf of the data controller.

RESULT:

1. As stated in the related regulation on VERBIS registration and decision numbered 2019/265; data controllers based abroad must register anyway; and data controllers based in the country must register with VERBIS by 31.12.2019, if the annual number of employees is more than 50 or the total of annual financial balance sheet is more than 25 million TL.

If there is a partner or founder of a resident data controller who is also resident legal entity abroad and if this legal entity based in abroad is using this personal data which was transferred to him from Türkiye for its own purposes, resident data controller and non-resident data controller are obliged to register with VERBIS separately.

2. If your company has a data processing activity as mentioned above by the partner or founder of the company located abroad, it is required to take a decision to appoint a data controller representative and to complete the VERBIS registration process by 31.12.2019 sharing this decision with the Board.

The said resident data controller abroad may appoint your company, another legal or natural person as representative.

3. It's crucial to note that, in case of failure to fulfill its obligations of Personal Data Protection Law (KVKK) and other legislation for this legal entity based abroad, the sanctions in this respect shall be directed to the legal entity based abroad. The founder or partner of the company in Türkiye will not bear responsibility.

Author CottGroup Hukuk ve Mevzuat Ekibi, Category Personal Data Protection Law

  • Notification!

    Contents provided in this article serve to informative purpose only. The article is confidential and property of CottGroup® and all of its affiliated legal entities. Quoting any of the contents without credit being given to the source is strictly prohibited. Regardless of having all the precautions and importance put in the preparation of this article, CottGroup® and its member companies cannot be held liable of the application or interpretation of the information provided. It is strictly advised to consult a professional for the application of the above-mentioned subject.

    For each concrete situation, it is strongly advised to seek guidance from a professional advisor. If you are a customer of ours, please consult with your customer representative before taking any action related to the announcement. If you are not a customer, seek advice from an expert.

About The Author

/tr/mevzuat/item/yurt-disinda-yerlesik-veri-sorumlularinin-verbis-e-kayit-yukumlulugu-ve-sartlari

Other Legislation

Bu web sitesi çerez kullanıyor.

Bu internet sitesinde, kullanıcı deneyimini geliştirmek, verimli çalışmasını sağlamak ve istatistiki verileri takip etmek için çerezler kullanılmaktadır. Sitemizi kullanarak çerezleri kabul etmiş olursunuz. Çerezleri nasıl kullandığımız ile ilgili detaylı bilgi için lütfen Çerezler (Cookies) sayfasını okuyunuz. Bu seçim 30 gün süreyle ya da tarayıcınızdaki çerezleri siz silene kadar geçerlidir.

Çerez Tercihleri Cookie Preferences

Çerezleri Ayarla

Çerezler, web sitelerinin kullanıcı deneyimini daha verimli hale getirmek için kullanabileceği küçük metinlerdir. Kanun, bu sitenin işleyişi için kesinlikle gerekli olan çerezlerin cihazınıza saklanabileceğini belirtir. Diğer tüm çerez türleri için izninize ihtiyacımız var. Bu site, çeşitli türde çerezler kullanmaktadır. Bazı çerezler, sayfalarımızda görünen üçüncü taraf hizmetler tarafından yerleştirilir.

Verdiğiniz izinler aşağıda yer alan web siteleri için geçerlidir:

  • www.cottgroup.com