The Decision of Personal Data Protection Board No. 2018/88 of 19/07/2018 on “The Starting Dates of Obligation to Register with the Data Controller’s Registry”

The Decision of Personal Data Protection Board No. 2018/88 of 19/07/2018 on “The Starting Dates of Obligation to Register with the Data Controller’s Registry”

Decision Date : 19/07/2018

Decision No : 2018/88

Subject Summary : The starting dates of the obligation to register with Data Controllers’ Registry

By taking into consideration the provisions “Natural or legal persons who process personal data shall register with the Data Controllers’ Registry prior to the start of data processing. However, by taking into account the objective criteria set by the Board such as the nature and quantity of the data processed, that data processing is laid down in a law, or transferring the data to third parties, the Board may provide derogation from the obligation of registration with the Data Controllers’ Registry.” in the Article 16(2) and “Data controllers are obliged to register with the Data Controllers’ Registry within the time specified and announced by the Board.” in the Provisional Article 1(2) of the Personal Data Protection Law No. 6698;

The Board has adopted the following decisions unanimously:

• For natural and legal person data controllers whose number of employees is more than 50 or annual financial balance sheet is greater than 25 million Turkish Liras, the starting date of obligation to register with Data Controllers’ Registry is 01.10.2018 and the deadline for the registration of these data controllers is 30.06.2020[1] ,
• For data controllers which are natural and legal persons not established in Turkey, the starting date of obligation to register to Data Controllers’ Registry is 01.10.2018 and the deadline for the registration of these data controllers is 30.06.2020[2] ,
• For natural and legal person data controllers whose number of employees are fewer than 50 and annual turnover is less than 25 million Turkish Liras as well as their field of main activity is processing special categories of personal data, the starting data of obligation to register with the Data Controllers’ Registry is 01.01.2019 and the deadline for registration of these data controllers is 30.09.2020[3],
• For public institutions and organizations, the starting date of obligation to register with the Data Controllers’ Registry is 01.04.2019 and the deadline for the registration of these data controllers is 31.12.2020[4],
• This Decision will be published on the Official Website of the Authority and in the Official Gazette.