What is Registry of Data Controllers (“Registry”)?
Registry, is a system which Data Controllers shall enrol in and declare their data processing activity. It is regulated under Art 16 of the Law on the Protection of Personal Data (“Law”). With the constitution of Registry, it is aimed to make Data Controllers public and provide effective use of right to data protection.
Registration;
a. In General
Registration will be made via document which shall include information regarding data processing, predetermined by the Personal Data Protection Board (“Board”) (such as; identification and address information of data controllers’ and its representatives’ -if available-, purpose of data processing, personal data which is envisaged to be transferred abroad).
Changes to the information provided as per aforementioned shall be immediately reported to the Board.
b. Exemptions to the Obligation to Enrol
In principle, all Data Controllers shall enrol in the Registry. However, the Law authorises the Board to set forth exemptions to the obligation to enrol in the Registry. While exercising this authorization, the Board shall consider some objective criteria such as the characteristics and the number of data to be processed, whether or not data processing is based on any law, or whether data will be transferred to third parties.
Data Controllers Who are Exempted from the Obligation to Enrol in the Registry upon Decisions of the Board;
a. Exempted Data Controllers with Decision dated 02.04.2018 and numbered 2018/32.
b. Exempted Data Controllers with the dated 28.06.2018 and numbered 2018/68 Decision
“Customs Brokers and Authorized Customs Brokers” who are working in accordance with the numbered 4458 Customs Law.
c. Exempted Data Controllers with the dated 05.07.2018, numbered 2018/75 Decisions
“Mediators” who are operating in accordance with the numbered 6325 Mediaton Law.
d. Exempted Data Controllers with the dated 19.07.2018, numbered 2018/87 Decision
Natural or legal person Data Controllers, whose main business area is not processing of special categories of personal data, are exempted from obligation to enrol in the Registry providing that their “annual employee number is less than 50 or annual financial statement amount is less than 25 millions Turkish Liras”.
Data Controllers Who are Exempted from Obligation to Enrol in the Registry pursuant to Art 16 of numbered 6698 Law on the Protection of Personal Data;
|
DATA CONTROLLER |
DECISION OF THE BOARD |
|
DATE OF THE OFFICIAL GAZETTE |
|
|
DATE |
NUMBER |
|||
|
1 |
Data Controllers who process personal data by otherwise than by automatic means which form part of a filing system |
02.04.2018 |
2018/32 |
15.05.2018 |
|
2 |
Notaries |
02.04.2018 |
2018/32 |
15.05.2018 |
|
3 |
Associations, Endowments, Unions |
02.04.2018 |
2018/32 |
15.05.2018 |
|
4 |
Political Parties |
02.04.2018 |
2018/32 |
15.05.2018 |
|
5 |
Attorneys |
02.04.2018 |
2018/32 |
15.05.2018 |
|
6 |
Independent Accountants and Financial Advisors and Certified Public Accountants |
02.04.2018 |
2018/32 |
15.05.2018 |
|
7 |
Customs Brokers and Authorized Customs Brokers |
28.06.2018 |
2018/68 |
18.08.2018 |
|
8 |
Mediators |
05.07.2018 |
2018/75 |
18.08.2018 |
|
9 |
Natural or legal person Data Controllers, whose main business area is not processing of special categories of personal data, providing that their “annual employee number is less than 50 or annual financial statement amount is less than 25 millions Turkish Liras”. |
19.07.2018 |
2018/87 |
18.08.2018 |
|
IMPORTANT NOTE – Being exempted from enrolling in the Data Controllers Registry cannot be understood as they are also exempted from the Law on the Protection of Personal Data numbered 6698. Therefore, they shall comply with the Law no.6698 just like the other Data Controllers.
|
If there is need of any other information about the article, please contact the below stated person.
|
Ersin Nazalı Managing Partner, Attorney, CPA enazali@nazali.av.tr |
Hatice Zümbül Director, Litigation and Dispute Resolution hzumbul@nazali.av.tr |