Have You Completed Your VERBIS Registration?

Certain periods and deadlines stipulated in Turkish Data Protection Law (KVKK) for VERBIS registration with the decision dated 19.07.2018 and numbered 2018/88. Afterward, these periods were extended 4 times, and the deadlines were postponed for various reasons.

With the decision numbered 2018/88, the deadline for VERBIS registration was determined as 30.09.2019 for data controllers with an annual number of employees over 50 and for data controllers residing abroad.

With the decision numbered 2019/265, the deadline for the above-mentioned data controllers was determined as 31.12.2019; with the decision numbered 2019/387 it was extended as 30.06.2020; with the latest decision numbered 2020/482, it was determined 30.09.2020 and lastly, it was determined as 31.12.2021 with the latest decision numbered 2021/238.

The deadline determined with the latest decision is not postponed, and the deadline for registration has been finalized hereof.

What Are the Points to Be Considered By Data Controllers as of This Deadline?

The logs of the data controllers who have performed their registrations and notifications to VERBIS can be viewed publicly in the registry system (VERBIS) as of the date of their notification.

The obligations of data controllers are always to keep these logs up-to-date in line with their current status. In case of a change in their processes, data controllers must complete the updates on the data inventories and VERBIS logs within 7 days at the latest and make them available to the public by notification.

Is It Possible to Perform VERBIS Registration After This Date?

Although 31.12.2021 is the deadline for the registration, data controllers can still register after this date.

As it is known, some criteria have been specified for the obligation to register with VERBIS, and no registration obligation has been stipulated for data controllers who do not meet the criteria prior to this date. After this date, data controllers who meet the criteria must make a notification by registering on the first date once the criteria are met, that is, the first date of registration.

Data controllers who met the criteria before 31.12.2021, but who have not fulfilled their registration obligation can register to VERBIS after this date; whereas, in this case, liabilities may arise for these data controllers as they have not duly performed their obligations. However, the Turkish DPA has the discretionary power regarding the implementation of sanctions; thus, fulfilling the obligation without delay is likely to have a more positive result than performing no registration.

In any case, it is indispensable for data controllers to fulfill this obligation as soon as possible.

Should you require any further details on the subject, you can visit our website VeriSistem^® or contact your client representative via the link.

Current Deadlines Provided By The Turkish DPA For VERBIS Registration: