The Turkish Personal Data Protection Board (the "Board") has published today its decision numbered 2019/387 regarding the extension of the deadline for the requirement to register with the online platform of the data controllers' registry (i.e. VERBIS).

The new deadlines are as follows:

Data Controller


Data controllers who have more than 50 employees or an annual balance sheet above TL 25 million

30 June 2020

Data controllers residing or registered outside of Turkey

30 June 2020

Data controllers who have less than 50 employees and an annual balance sheet above TL 25 million, but process special category personal data as part of its main activity

30 September 2020

Data controllers who are public institutions

31 December 2020

The annual balance sheet of 2019 will be taken into consideration for the above purposes.

The registration requirement is satisfied by (i) registering the data controller with VERBIS; and (ii) registering online the information about the data controllers' data processing activities. To that extent, data controllers must make sure that a data processing inventory is prepared and a compliance and risk analysis has been completed on that basis in order to comply with all requirements with regards to the VERBIS registration.

Data controllers who fail to comply with the registration requirements may be subject to monetary penalties between TL 20,000 and TL 1,000,000.1

On a separate note, other obligations of data controllers such as preparing information notices, obtaining explicit consents, if required and entering into data transfer agreements still continue notwithstanding the above deadlines and must be completed as soon as possible.


1 Please note that such amounts may increase within 2020.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.