Personal Data Protection and VERBIS Registration Obligations of Representative Offices, Direct Activities, and Branches of International NGO’s Located in Turkey

VERBIS Registration Obligation of Data Controllers that Processes Data through a Branches, Representative or Direct Activities Offices

All data controllers are obligated to take the necessary administrative and technical measures within the scope of KVK; however, not all are required to register with the Data Controllers Information Registry ("VERBIS"). This has created some confusion for branches, representatives, and direct activities offices of international NGOs (“INGOs”).

The decision of the Personal Data Protection Board (“Board”) dated 04.22.2020[1] indicates that associations located in Turkey are exempt from the VERBIS registration obligation. This exemption includes the branch, representative, and direct activities offices of INGO’s located in Turkey. However, INGOs that process personal data directly or through their branches, representative, or direct activities offices in Turkey are obligated to register in VERBIS. Therefore, the registration obligation will not be the branch, representative, or direct activities office in Turkey, but the INGO itself.

With the resolution of the Board dated 11 March 2021, the deadline for VERBIS registration has been postponed to 31.12.2021[2].
 

Other Obligations of the Data Controller Within the Scope of Personal Data Protection

Data controllers are required to take administrative and technical steps to ensure the safety of the personal data they process. These include the obligation to inform data subjects, carrying out data analysis, creating a data inventory, preparation of data governing documents (such as Personal Data Retention and Disposal Policy), ensuring erasure, destruction, or anonymization of personal data, carrying out awareness training for employees and implementing other available measures.
 

Penalties for Breach of VERBIS Registration Obligations

The Board is authorized to impose administrative fines on real persons and legal entities that do not fulfill the administrative and technical measures and VERBIS registration obligations stipulated in the relevant legislation. Some administrative fines determined under the KVK are listed below:

1. TRY 9.834 to TRY 196.686 for data controllers who do not fulfill the obligation of clarification,

2. TRY 29.503 to TRY 1.966.862 for data controllers who do not fulfill the obligation of data security,

3. TRY 49.172 to TRY 1.966.862 for data controllers who do not fulfill the Board’s decisions regarding procedures and principles,

4. TRY 39.337 to TRY 1.966.862 for failure to register with VERBIS.

Moreover, the Turkish Criminal Code regulates several different crimes with respect to personal data. The crimes may be punishable with a prison sentence between 1 to 8 years. Compliance projects relating to the protection of personal data are likely to significantly decrease risks relating to the realization of these crimes.
 

Unforeseen Danger for Representation Offices

The administrative fines imposed on date controllers located abroad are likely to be addressed to their branch, representative, or direct activities office in Turkey. In the event the data controller fails to fulfill its payment obligations, the respective administrative fine may be enforced on the personal assets of the registered representatives of the INGO in accordance with the Law on the Procedure for the Collection of Public Debt.

Conclusion 

VERBIS registration is mandatory for INGOs that process personal data from Turkey directly or through their registered offices. Significant administrative fines are determined in the law for the breach of these obligations. The deadline for VERBIS registration has been postponed to 31.12.2021. The registration process shall include analyses of personal data processed from Turkey, drafting personal data inventory, and drafting certain legal documents which can take up to 3 to 4 weeks.
 

(This content has been updated on 12 March 2021. )

[1] https://www.kvkk.gov.tr/Icerik/6740/2020-315

[2] https://www.kvkk.gov.tr/Icerik/6903/VERBIS-E-KAYIT-SURELERININ-UZATILMASI-HAKKINDA-DUYURU