In accordance with Article 16 of the Personal Data Protection Law No. 6698 (“KVKK” and “PDPL”) as well as Articles 8 and 16 of the Regulation on the Registry of Data Controllers (“Regulation”); the “annual financial balance sheet total” amount, which was accepted as a criterion for the exemption from the obligation to register with the Data Controllers Registry (“Registry”) with the Board decision dated 19.07.2018 and numbered 2018/87 (“Decision”) given by the Personal Data Protection Board (“Board”), has been re-evaluated under the economic conditions in Turkey.
Article 8 of the Regulation contains the following statement:
“Data controllers must fulfil their obligations to register with the Registry before starting to process personal data.”
Accordingly, data controllers must register with the Registry before proceeding with personal data processing.
Article 16 of the Regulation is as follows:
“The Board may make exceptions to the registration obligation by considering the following criteria:
- The nature of the personal data.
- The number of personal data.
- Purpose of processing personal data.
- The field of activity in which the personal data is processed.
- The status of transfer of personal data to third parties.
- The personal data processing activity arises from the law.
- Duration of retention of personal data.
- Data subject group or categories of data.
- Annual number of employees or annual financial balance sheet total of the data controller.”
Pursuant to this Article, the Board may make exceptions to the obligation to register with the Registry by taking into account the data controller’s annual number of employees and annual financial balance sheet total.
In the Board’s decision dated 19.07.2018 and numbered 2018/87, the limits of the annual number of employees and the annual financial balance sheet total were determined by saying “real or legal person data controllers whose annual number of employees is less than 50 and whose annual financial balance sheet total is less than 25 million Turkish Liras and whose main activity is not processing special categories of data.”
With the Decision dated 06.07.2023, it was decided to update this previously determined annual financial balance sheet total amount. With the Decision, these amounts have been updated with the following statement:
“Natural or legal person data controllers whose annual number of employees is less than 50 and whose annual financial balance sheet total is less than 100 million Turkish Liras, whose main field of activity is not special categories of data processing.”
Accordingly, the total annual financial balance sheet must be less than 100 million Turkish liras for the data controllers to fall within the scope of the exemption.
The decision will enter into force on the date of its publication in the Official Gazette.
You can reach the full text of the Decision from the link below:
https://www.resmigazete.gov.tr/eskiler/2023/07/20230725-5.pdf
