Turkish Data Protection Authority Amends Exemption Criteria For Data Controller Registration

With Decision no. 2023/1154 dated 6 July 2023, the Turkish Data Protection Authority has amended the criteria for data controllers to be exempt from the requirement to register with the Data Controller Registry (VERBİS) pursuant to Turkish Personal Data Protection Law no. 6698 and secondary legislation. The decision was published in Official Gazette no. 32259 dated 25 July 2023 and entered into force on the same date.

The decision increases the exemption threshold based on the data controller's annual balance sheet from TRY 25,000,000 to TRY 100,000,000 in view of current economic conditions in Turkey. Accordingly, as of 25 July 2023, data controllers established in Turkey whose number of employees is below 50 and whose annual total balance sheet is below TRY 100,000,000 are exempt from VERBİS registration, unless they process sensitive data as part of their main activity. Other exemptions previously granted to specific data controller groups, such as notaries