The Personal Data Protection Board ("Board"), through its decision dated 06.07.2023 and numbered 2023/1154 published in the Official Gazette dated 25.07.2023 and numbered 32259, has decided to increase the monetary threshold regarding the total annual financial balance sheet from TRY 25 million to TRY 100 million as one of the criteria for exemption from Obligation to Register with the Data Controllers' Registry ("VERBIS").
According to the Board's decision dated 19.07.2018 and numbered 2018/87, data controllers within this scope were excluded from the VERBIS registration obligation with the expression "real or legal person data controllers whose main activity is not processing special categories of personal data, whose annual number of employees is less than 50 and whose total annual financial balance sheet is less than TRY 25 million.
The definition of "small enterprise" in the Regulation on the Definition, Qualifications and Classification of Small and Medium-Sized Enterprises, which was the ground for the application of the exemption criterion in terms of the financial balance sheet at the time of the publication of the relevant Board decision, was amended in May to "enterprises with less than fifty employees and whose annual net sales revenue or financial balance sheet does not exceed one hundred million Turkish Liras".
The Board evaluated that businesses in Turkey have grown in terms of economic indicators and expanded their business volumes, considering that the monetary threshold of TRY 25 million, which was based on 2018 data, remained low based on the current annual financial statement totals of the enterprises. Therefore, the Board decided to increase the monetary threshold for the total annual financial balance sheet in the financial statements from TRY 25 million to TRY 100 million within the scope of exemption criteria for VERBIS registration obligation.
VERBIS registration obligation starts for data controllers resident in Türkiye only if one of the conditions regarding the number of employees and the total annual financial balance sheet is fulfilled. As of the publication date, the relevant decision has become effective and data controllers are required to check whether these conditions are met and data controllers who subsequently become obliged to register are required to register with VERBIS within 30 days following their obligation. We would like to emphasize that the thresholds do not apply to foreign data controllers and these data controllers are subject to this obligation regardless of the number of employees and total annual financial balance sheet.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.