The law on Protection of Personal Data was published in the Official Gazette of 7 April 2016 and came into force on the very same day. The Personal Data Protection Law, which governs the details of protection, processing and storage of personal data, requires enrolment to the Data Controllers' Registry. Accordingly, before processing any personal data, data controllers are obliged to register with the Data Controllers' Registry. In other words, natural and legal persons who process personal data must be registered under this registry before processing any personal data. The data controllers' interactions with the Data Controllers' Registry are conducted through VERBIS (Data Registration Information System). VERBIS is an information system established and governed by the Data Management Office and used for registration by the data controllers. The newsletter on Personal Data Protection Law in Turkey was first published in our GvW International Newsletter in June 2016. More information and a link to the full newsletter may be found here.

Obligations on data controllers are imposed in terms of information requirements and providing data safety. However, the regulation sets forth some exemptions to the registration requirement. In that respect, the Data Protection Board may announce exemptions regarding the obligation to register providing, in accordance with objective criteria such as the nature and number of processed personal data, whether or not data processing is required by law or whether or not data will be transferred to third parties.

The Data Protection Board has recently announced exemptions for certain data controllers who will not be obliged to register with the Data Controller’s Registry. The regulation on the exemptions was published in the Official Gazette of 15 May 2018.

The exemptions that the regulation introduces are listed below:

• Data controllers who process the personal data through non-automatic means as a part of a data recording system,
• Public notaries governed by the Law no. 1512,
• Associations, foundations and trade unions, established in accordance with the relevant legislation, which are limited only to their fields of activity and just process personal data of their own employees, members and donors,
• Political parties regulated under the Law no. 2820,
• Freelance financial consultants and certified public accountants under the Law no. 3568,
• Lawyers under the Law no. 1136.

The regulation brings more specific and clear instructions regarding objective criteria and seeks to fulfil the responsibilities of the legislature with a lower cost and create a system where all areas are covered by the Law. Accordingly, provisions regulating the exemptions under Data Protection Law in Turkey and the EU have been harmonized. The scope of the exemptions for certain data controllers are left with a narrow range, however, at this stage the purpose of the registration obligation is to establish the Data Controllers` Registry (which is publicly available) under the supervision of the Data Protection Board.

It has to be noted that the scope of the exemption where there are no clear boundaries yet have to be determined. Moreover, the exemptions of registration to the Data Controllers' Registry will not remove or negate any other liabilities or additional obligations imposed on the data controllers under the Law no. 6698.

Dr Gökce Uzar Schüller
Lawyer
Frankfurt and Istanbul

Seyma Özcömert
Trainee
Frankfurt