KVKK VERBİS Obligation and Administrative Sanctions
07/05/2024Pursuant to Article 16 of the KVKK (Personal Data Protection Law), data controllers in Turkey are obliged to register in a system called VERBİS (Data Controllers Registry Information System) in order to record and monitor their personal data processing activities. VERBİS is a platform created by the Personal Data Protection Authority and data controllers are required to register and report their personal data processing activities. The information to be entered into this system is defined in Article 16 of the Law. If data controllers who are obliged to register with VERBİS fail to fulfill their registration obligations or make incomplete notifications, administrative fines are imposed. Details regarding the penalties to be imposed are defined under the heading "Administrative Sanctions" of this document.
VERBİS Registration and Notification Obligation
Pursuant to the decision published by the KVKK, all data controllers with VERBIS obligations were expected to complete their registration until March 31, 2021. Due to the pandemic in our country and the effect of remote working, many data controllers could not fulfill this obligation, and the Board issued a new decision and extended the registration period until December 31, 2021. All data controllers were expected to notify by this date.
The Personal Data Protection Authority published a public announcement (https://www.kvkk.gov.tr/Icerik/7250/Kamuoyu-Duyurusu-VERBIS-) , on April 21, 2022 regarding the data controllers who have not completed VERBİS registration until December 31, 2021, and stated that administrative sanctions have started to be imposed in accordance with Article 18 of the Law on data controllers who are found to have failed to fulfill their registration and notification obligations. As can be understood from this announcement, it is considered that there will be no extension of the VERBİS registration period and that the registrations should be completed as soon as possible. If the data controllers meet the conditions stated below; they should apply for VERBİS (https://verbis.kvkk.gov.tr/) as soon as possible, prepare data inventories by analyzing the personal data they process (including the minimum information required for notification to VERBİS) and make VERBİS entry using the data in the inventory.
As of July 25, 2023, all companies (natural and legal persons) and all public institutions/organizations with more than 50 employees or a total annual financial balance sheet of more than 100 million TL are obliged to register with VERBİS. All companies with more than 50 employees must register with VERBİS. Companies with fewer than 50 employees are also required to register with VERBİS if their annual balance sheet exceeds 100 million TL. In this context, many companies are subject to VERBİS obligation.
Within the scope of the current VERBİS registration conditions published by the KVKK, the VERBİS registration obligation of the data controllers who are newly subject to these conditions has started, and May 30, 2023 is the deadline for completing the registration. The penalties defined below will start to be applied for those who do not register to the registry until this date.
Administrative Sanctions
Article 18 of the Law was also updated in the amendment of the KVKK, which was adopted by the General Assembly on March 2, 2024 and will enter into force on June 1, 2024. With the current amendment, the fine amount from 20,000 TL to 1,000,000 TL has been updated between 50,000 and 1,000,000 TL.
The Personal Data Protection Board published an update regarding the penalty amounts on January 5, 2024 (https://www.kvkk.gov.tr/Icerik/7790/6698-Sayili-Kisisel-Verilerin-Korunmasi-Kanunu-Kapsaminda-Idari-Para-Cezasi-Tutarlari) , and the amounts published by the Board will be taken as the basis. As of this date, administrative fines between 189,245 TL and 9,463,213 TL will be imposed on data controllers who do not fulfill their VERBİS obligation. For public institutions and organizations that do not fulfill the VERBİS obligation, the result will be notified to the Board by applying the disciplinary provisions. In this context, it is of great importance that data controllers who have not registered with the Registry complete their data entry by registering as soon as possible.
Get in Touch