The Personal Data Protection Authority (“Authority”) published a public announcement on the Authority’s website on 21.04.2022 about the obligation to register and notify in the data controllers registry.
As it is known, pursuant the Decision dated 11.03.2021 and numbered 2021/238 of the Personal Data Protection Board, natural and legal data controllers with an annual number of employees of more than 50 or with an annual financial balance sheet total of more than 25 million TL, natural and legal person data controllers residing abroad, natural and legal person data controllers whose main field of activity is to process special personal data but whose annual number of employees is less than 50 and annual financial balance is less than 25 million TL were given time to fulfil their registration and notification obligation to the registry until 31.12.2021.
Pursuant to Article 18 paragraph 1-ç of the Personal Data Protection Law (“PDPL”), with the provision “An administrative fine from 20,000 Turkish lira to 1,000,000 Turkish lira is imposed on those who violate the obligation to register and notify in the Data Controllers Registry” stipulated in article 16 of the PDPL and with the provision “In case the acts listed in the first paragraph are committed within the body of public institutions and organizations and professional organizations in the nature of public institutions, upon the notification to be made by the Board, action is taken against the civil servants and other public officials working in the relevant public institutions and organizations, and those working in professional organizations deemed as public institutions, in accordance with the disciplinary provisions and the result is reported to the Board.” stipulated in paragraph 3 of the same article, it has been regulated that administrative sanctions may be imposed ex officio by the Board to data controllers who do not fulfill their obligation to register and notify in the Registry.
With the related public announcement, the Authority stated that administrative sanctions have been started to be imposed in accordance with article 18 of the PDPL to data controllers who are found to have not fulfilled their obligation to register and notify the Registry.
You may reach the full Turkish version of the public announcement via the link below:
