Pursuant to the Law No. 6698 on the Protection of Personal Data ("Law"), the Personal Data Protection Board ("Board") can take decisions to make exceptions to the obligation to register with the Data Controllers Registry ("Registry") and to determine the scope of the exceptions and the procedures and principles regarding their implementation.
In the light of foregoing, with the Board decision numbered 2018/87 published in the Official Gazette dated 18.08.2018, the real or legal person data controllers having less than 50 employees per year and with an annual financial balance sheet total of less than 25 million TRY, whose main field of activity is not processing of sensitive (special categories of) data, are exempted from the obligation to register in the Registry.
In the public announcement made by the Board on 25 July 2023, considering that the enterprises in Turkey have grown in terms of economic indicators, their business volumes have expanded since the date of the publication of the said Board decision, and the 25 million TRY limit taken as a basis in 2018 is lower than the current annual financial balance sheet totals, it has been reported that a need to update the annual financial balance sheet total amount determined in the Board decision numbered 2018/87 arose.
In line with the reasons explained in the Board's above-mentioned announcement, the updated exemption conditions for the following data controllers are officially announced by the Board on 25.07.2023 with the Board's decision dated 06.07.2023 and numbered 2023/1154:
"The real or legal person data controllers, whose annual number of employees is less than 50 and whose annual financial balance sheet total is less than 100 million Turkish liras, whose main field of activity is not processing sensitive (special categories of) personal data, are exempted from the obligation to register in the Registry.
It is strongly recommended that all data controllers, who currently are or are not registered with the Registry due to previous exemption criteria, provide their own status checks on the updated criteria and check whether they are under the registration obligation. Mind the Law that those who violate the obligation to register and notify with the Data Controllers Registry are subject to administrative fines from 119,428.- TRY to 5,971,989 TRY.
Originally published 27 July 2023
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
