Board Decision on Data Controllers to be Derogated from the Obligation of Registration with the Data Controllers’ Registry

Board Decision on Data Controllers to be Derogated from the Obligation of Registration with the Data Controllers’ Registry

Decision Date : 19/07/2018

Decision Number : 2018/87

Subject Summary : Natural or legal person data controllers who have fewer than 50 annual employees and whose annual financial balance sheet is less than 25 million TL will be derogated from the registration obligation, as long as their primary activity is not processing special categories of personal data.

Having regard to the provision in the Article 16(2) of the Personal Data Protection Law No. 6698 “Natural or legal persons who process personal data shall register with the Data Controllers’ Registry prior to the start of data processing. However, by taking into account the objective criteria set by the Board such as the nature and quantity of the data processed, that data processing is laid down in a law, or transferring the data to third parties, the Board may provide derogation from the obligation of registration with the Data Controllers’ Registry.” and by taking into consideration the Article 16 titled ‘Derogation Criteria’ of By-Law on the Data Controllers’ Registry which entered into force by being published in the Official Gazette No. 30286 of 30.12.2017; in addition to data controllers that are provided with derogation by the Decision of Board No. 2018/32 of 02/04/2018, the Board unanimously decided that natural or legal person data controllers who have fewer than 50 annual employees and whose annual financial balance sheet is less than 25 million TL will be derogated from the registration obligation, as long as their primary activity is not processing special categories of personal data and this Decision will be published on the Official Website of The Authority and in the Official Gazette.