With Decision no. 2023/1154 dated 6 July 2023, the Turkish Data Protection Authority has amended the criteria for data controllers to be exempt from the requirement to register with the Data Controller Registry (VERBİS) pursuant to Turkish Personal Data Protection Law no. 6698 and secondary legislation. The decision was published in Official Gazette no. 32259 dated 25 July 2023 and entered into force on the same date.

The decision increases the exemption threshold based on the data controller’s annual balance sheet from TRY 25,000,000 to TRY 100,000,000 in view of current economic conditions in Turkey. Accordingly, as of 25 July 2023, data controllers established in Turkey whose number of employees is below 50 and whose annual total balance sheet is below TRY 100,000,000 are exempt from VERBİS registration, unless they process sensitive data as part of their main activity. Other exemptions previously granted to specific data controller groups, such as notaries public,

The above exemption criteria only apply to data controllers located in Turkey. Data controllers established abroad who process personal data collected in Turkey remain subject to VERBİS registration without any exemption

As announced on its website on 21 April 2022, the Turkish Data Protection Authority has started to impose fines on the data controllers who have failed to register with the Data Controller Registry. In the past year, the Turkish Data Protection Authority’s enforcement efforts have also been more specifically aimed at data controllers established abroad who target data subjects in Turkey. The failure to comply with the VERBİS registration requirement may result in the imposition of fines ranging from TRY 119,428 to TRY 5,971,989 (approx. EUR 4,000 to EUR 200,000) in 2023.
These monetary thresholds are subject to annual adjustment.

Data controllers who are not subject to registration remain under the obligation to comply with all other requirements of the Turkish data protection legislation.