NEW EXEMPTIONS TO THE REGISTRATION OBLIGATION OF THE DATA CONTROLLERS

As per the Article 16/2 of the Data Protection Law; natural or legal persons who process personal data shall be obliged to register to the Data Controllers Registry before proceeding with data processing. However, by considering the objective criteria set by the Personal Data Protection Board (“Board”) such as the nature and quantity of the data processed, the legal requirement for data processing, or transferring the data to third parties, the Board may provide exception to the obligation of enrollment in the Registry of Data Controllers. The board recently announced new exemptions by the decisions numbered 2018/68, 2018/75, 2018/87 and 2018/88 with the Trade Registry Gazette dated August 18, 2018. You may find below information regarding the new exemptions that are recently announced by Personal Data Protection Board.

I. LEGAL BACKGROUND

Data Protection Law numbered 6698 (published in the Official Gazette dated April 7, 2016 and numbered 29677) (the “Law”);

Regulation on Data Controllers Registry (published in the Official Gazette dated December 30, 2017 and numbered 30286) (the “Regulation”);

Board’s Resolutions on Exemptions of Registration to the Data Controllers Registry (published on August 18, 2018 and numbered 2018/68, 75, 87, 88).

I. DECISION NUMBERED 2018/68

According to the decision numbered 2018/68, customs brokers and authorized customs brokers shall be exempted from registering to the Registry.

II. DECISION NUMBERED 2018/75

Pursuant to the decision numbered 2018/75 mediators shall be exempted from registering to the Registry.

III. DECISION NUMBERED 2018/87

According to the decision numbered 2018/87, real person or legal entity Data Controllers whose annual number of employees is less than 50 and whose annual balance is less than TRY 25,000,000 shall be exempted from registering to the Registry if their main area of activity is not processing special kind of personal data.

III. DECISION NUMBERED 2018/88

Pursuant to the decision numbered 2018/88, the registration obligation of real person or legal entity Data Controllers whose annual number of employees is more than 50 and whose annual balance is more than TRY 25,000,000 has begun on October 1, 2018 and the registration should be completed until September 30, 2019, at the latest.

The registration obligation of real person or legal entity Data Controllers located in abroad has begun on October 1, 2018 and the registration should be completed until September 30, 2019, at the latest.

Real person or legal entity Data Controllers whose main area of activity is processing special kind of personal data but has less than 50 employees and if the annual balance is less than TRY 25,000,000 the registration obligation will begin on January 1, 2019 and the registration is required to be completed until March 31, 2020, at the latest.

For the Data Controllers who are public authority’s registration obligation will begin on April 1, 2019 and the registration should be completed until June 30, 2020.

The information provided in this article is general and may not apply in a specific situation. Legal advice should always be sought before taking any legal action based on the information provided. The information is not intended create, nor does receipt of it constitute, an attorney-client relationship.

For any questions regarding the article, please contact us: