VERBIS Registration Obligation and Conditions for the Data Controllers Resident Abroad

In the event that some or all of the personal data is transferred to the founder / partner foreign company located abroad and the foreign company uses this data for its own purposes, there is an obligation to register with the Data Controller’s Registry Information System (“VERBIS”). These transfers, in general, consist of recordings of all or part of the data of the employees, suppliers and customers of the legal entity in Türkiye to a registration system which is provided and managed by foreign partner. However, keeping only personal data in a registration system by the foreign partner does not constitute VERBIS registration obligation and the foreign partner should use this data for their own purposes.

In accordance with this explanation; the legal entity resident abroad or with a partner company's founder identity in Türkiye has to register with Data Controllers’ Registry (hereinafter referred to as “VERBIS”) by means of a Data Controller Representative; and the legal entity based in Türkiye acting as data controller has to register with VERBIS, if they meet the requirements below are met.

We share the related sections of the relevant legislation, decisions and guidelines below:

According to the Article 5 of Regulation on VERBIS,

Procedures and Principles

(b) Data controllers non-resident in Türkiye, are obliged to register with VERBIS by means of a data controller representative before processing any data.

According to the Article 11 of Regulation on VERBIS,

Obligations of the data controller, data controller representative and the contact person

(2) Certified copies of the decision to be taken by the authorized body or person regarding to the appointment of data controller representative of the data controller who is non-resident in Türkiye, are submitted to the Board by the data controller representative during VERBIS registration.

Personal Data Protection Board Decision dated 03/09/2019 and numbered 2019/265

With the Board's decision numbered 2019/265, the deadline for registration is defined as 31.12.2019, for natural person / legal entities based abroad.

According to the Article 3 of the European Union Data Protection Regulation (GDPR)

(2) The law also applies to the processing of the personal data of the data subjects in the EU by a controller or processor that is not established in the EU, as well.

(Here, depending on the reciprocity principle; KVKK also applies, if data controllers process data, who are non-resident in Türkiye. Accordingly, data controllers based abroad, must register with VERBIS.)

DECISION OF APPOINTMENT

(Appointment Letter)

With the Article 11 of the Regulation on VERBIS, how to make decision of appointment and the procedures and principles are described. According to this;

1. Certified (Turkish translated and notarized) copy of the decision to be taken by the authorized body or person regarding to the appointment of data controller representative who is non-resident in Türkiye, are submitted to the Board by the data controller representative during VERBIS registration.

(Data controller resident abroad, must send the decision with wet signature including apostille or notary approval to the Board via regular mail, which is to be taken as described below, before registering with VERBIS. The Board, either approves or rejects the application sent through Registered Electronic Mail (hereinafter referred to as "KEP"), after also evaluating the decision of appointment.)

2. The decision to appoint a data controller representative shall be arranged to cover at least the following points:

• a) Notification or acceptance of notifications or correspondence made by the Authority on behalf of the data controller,
• b) Forwarding the requests of the Authority directed to the data controller to the data controller and forwarding the response of the data controller to the Authority,
• c) In case, no other basis has been determined by the Board; receiving applications of the relevant persons on behalf of the data controller and forwarding them to the data controller, in accordance with the first paragraph of the Article 13,
• ç) In case, no other basis has been determined by the Board; forwarding the response of the data controller to the relevant persons, in accordance with the third paragraph of the Article 13,
• d) Carrying out the works and transactions related to the VERBIS on behalf of the data controller.

RESULT:

1. As stated in the related regulation on VERBIS registration and decision numbered 2019/265; data controllers based abroad must register anyway; and data controllers based in the country must register with VERBIS by 31.12.2019, if the annual number of employees is more than 50 or the total of annual financial balance sheet is more than 25 million TL.

If there is a partner or founder of a resident data controller who is also resident legal entity abroad and if this legal entity based in abroad is using this personal data which was transferred to him from Türkiye for its own purposes, resident data controller and non-resident data controller are obliged to register with VERBIS separately.

2. If your company has a data processing activity as mentioned above by the partner or founder of the company located abroad, it is required to take a decision to appoint a data controller representative and to complete the VERBIS registration process by 31.12.2019 sharing this decision with the Board.

The said resident data controller abroad may appoint your company, another legal or natural person as representative.

3. It's crucial to note that, in case of failure to fulfill its obligations of Personal Data Protection Law (KVKK) and other legislation for this legal entity based abroad, the sanctions in this respect shall be directed to the legal entity based abroad. The founder or partner of the company in Türkiye will not bear responsibility.