Data controllers are obliged to take the necessary technical and administrative measures to ensure data privacy and data security within the scope of both the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the European Union General Data Protection Regulation ("GDPR") in Europe. These measures are not specified in a limited number, but they are stipulated to determine the need of data controllers for "necessity." This necessity differs for each activity.

In addition, the life cycle of personal data in the business activities of the organization changes over time. For example, a marketing activity or employee satisfaction activity may occur, which does not currently exist; an existing process may be terminated, the customer portfolio may expand from domestic to abroad, and private companies may be included into suppliers.

As it is known, the periods during which natural and legal persons who process personal data should be registered in the Data Controllers' Registry (Registry) were announced by the Turkish Personal Data Protection Board (Board) in accordance with the Law on the Protection of Personal Data (KVKK) numbered 6698.

There are certain periods and deadlines stipulated in the Turkish Data Protection Law (KVKK) for VERBIS registration with the decision dated 19.07.2018 and numbered 2018/88. Afterwards, these periods were extended 3 times and the deadlines were postponed for various reasons.

Negligence and violations regarding the protection of personal data impose heavy legal and criminal liabilities on business organizations.

The liabilities and amount of penalty fines due to the violation of the sanction according to the Article 18 of KVKK are as follows: