As is known, the real persons or
legal entities; who process personal data in terms of the Law on Protection of
Personal Data (“LPPD”) are liable as “data controllers”. Data controllers are required
to prevent illegal data processing and to ensure their proper storage. In
addition, data controllers are expected to register themselves to the Data Controllers
Registry (“Registry”) that will be kept by the Data Protection Board (“Board”).
As per Article 16 of the LPPD, the Board may set forth exemptions to the
obligation to register with the Registry.
The Board has announced the
deadlines to register to the Registry for certain data controllers.
Accordingly;
1. The obligation of the real
person and legal entity data controllers who employ more than 50 employees
annually or whose annual total financial statement is more than TRY 25 million
to register to the Registry will start on 01.10.2018 and these entities must register
to the Registry until 30.09.2019 at the latest,
2. The obligation of the real
person and legal entity data controllers who reside abroad to register to the
Registry will start on 01.10.2018 and these entities must register to the
Registry until 30.09.2019 at the latest,
3. The obligation of the real
person and legal entity data controllers who employ less than 50 employees
annually and whose annual total financial statement is less than TRY 25
million; but whose main field of activity is the processing of special
categories of personal data to register to the Registry will start on
01.01.2019 and these entities must register to the Registry until 31.03.2020 at
the latest,
4. The obligation of the state
institutions and organizations that have the attributes of data controllers to
register to the Registry will start on 01.04.2019 and these entities must
register to the Registry until 30.06.2020 at the latest.
On a separate note, the Board also announced
its new decisions regarding the exemptions in the Official Gazette dated
18.08.2018 and numbered 30513. According to such decisions, the Board has
declared the following persons exempt from registration to the Registry:
1. Customs brokers and authorized
customs brokers who engage in activities pursuant to the Customs Law No. 4458,
2. Mediators authorized pursuant to
Law No. 6325,
3. The real person and legal entity
data controllers who employ less than 50 employees annually and whose annual
total financial statement is less than TRY 25 million; whose main field of
activity is not processing of special categories of personal data.
Previously, in its decision dated
02.04.2018 and numbered 2018/32, the Board had exempted notaries public, those
who process data by only non-automatic means provided that they are part of any
data recording system, associations, foundations, some certain labor unions,
political parties, lawyers, independent
accountant and financial advisors and certified public accountants;
from registering to the Registry.