FAQ

Frequently Asked Questions On Registration Before The Data Controllers Registry For Non Resident Data Controllers

1- Appointment of a Data Controller Representative

In order to be able to complete registration before the Registry, Foreign Entity must appoint a data controller representative who must be either a Turkish national or a legal entity established in Turkey (“Data Controller Representative”). The appointed Representative must have the power to represent the foreign data controller before the Board and receive and facilitate communication from the Board and from any data subject in Turkey that files an application with regard to their rights guaranteed under the Data Protection Law.

Depending on the requirements of the jurisdiction in which the Foreign Entity is established Representative appointment document can be drafted as a decision of appointment or a power of attorney. The important points to consider are;

i) the method of appointment should be consistent and valid with regard to the requirements of jurisdiction in which the Foreign Entity is established,

ii) the document should be duly notarized by a notary and be apostilled (or otherwise be certified by a Turkish consulate located in the jurisdiction at which it is issued).

2- Preparation of a Personal Data Processing Inventory

According to the Turkish data protection legislation data controllers are required to prepare a personal data processing inventory (“Inventory”) containing at least the following information:

purposes of personal data processing activities
legal grounds of such processing activities,
data categories associated with such processing activities,
recipient groups of such processing activities,
data subject groups of such processing activities,
the maximum retention period required by the purposes of the processing, [1]
personal data envisaged to be transferred abroad, and
measures taken concerning data security.

While not completely identical, it should be noted that the scope and content of the Inventory is similar to the Records of Processing Activities (“RoPA”) required under Article 30 of the GDPR. Therefore, if within the scope of GDPR compliance the Foreign Entity has RoPA, these efforts can also be utilized as a basis of the inventory for VERBIS registration. The inventory shall not be uploaded to the Registry only the categorical information to be provided to the Registry should be based on the inventory.

Stated below is a comparison of Inventory and Records of Processing:

[1]Limitation of action period under Turkish legislation is 10 years. In this regard, the personal data that would constitute evidence could be stored maximum 10 years and the storage period would be legitimate. Nevertheless, decision of the retention periods of personal data should be made in accordance with the sector practices.

3- Fulfillment of the Sign-Up Form

Registration system sign-up form which is printed form document available at VERBIS’ website to request certain basic information both regarding the data controller (i.e. Foreign Entity) and the Data Controller Representative is requested. The following information is requested under the form:

4- What are the Registration Steps?

4 – Does the Foreign Entity Has to Pay a Fee with the Data Controllers Registration?

There is not any registration fee applied on the Regulator’s side.

5- After the Completion of the Registration How Often the Registration Records Should be Reviewed and Revised?

According to Article 13 of the Regulation on the Data Controllers Registry, “In the event of a change in the information registered to VERBİS, such changes must be notified via VERBİS within 7 days following the date of the change.”

As the information registered to VERBIS is categorical it is not expected that frequent changes would occur and affect the information declared to VERBIS. In any case it would be worth checking quarterly or in accordance with Foreign Entity’s internal Inventory/RoPA update policy. If the Foreign Entity implements changes that might have an impact over the submitted information, prior to the quarterly updates, timely reporting should be made in accordance with Article 13.

Frequently Asked Questions On Registration Before The Data Controllers Registry For Non Resident Data Controllers

1) Does Every Non-Resident Data Controller Should Register Before the Data Controllers Registry?

2) What is the Sanction of Not Completing the Registration Until the Deadline?

3) What are the Procedures to be Consummated by the Foreign-Established Data Controllers?