The Turkish Personal Data Protection Authority (KVKK) has announced that it has amended the criteria for exemptions from the obligation to register with the Data Controllers Registry. As of its publication in the Official Gazette on July 25th, 2023, the amendment now exempts data controllers with less than 50 employees and an annual financial statement of less than TRY 100 million (approximately $3.7 million) from the registration requirement, as long as their main activity does not involve processing special categories of personal data.
The KVKK noted that the original criteria for exemption were based on the definition of “small businesses” as stated in the Regulation on the Definition, Qualifications, and Classification of Small and Medium-sized Enterprises. On May 25, 2023, the Small and Medium-Sized Enterprises Regulation was updated, and as a result, the KVKK criteria were amended to reflect these changes.
The amendment was implemented after a comprehensive evaluation of the economic growth and increased operations of businesses in Turkey since 2018. These changes are expected to reduce the administrative burden on businesses.
The amendment takes effect immediately.
Exemption from registration in the data controllers’ registry does not release data controllers from their obligations under Law No. 6698. All data controllers are required to fully comply with their legal obligations before processing personal data.
Introduction to the KVKK
The KVKK is an independent authority entrusted with the responsibility of protecting personal data in Turkey. Established in 2016, the KVKK ensures that the processing of personal data in Turkey complies with the Personal Data Protection Law.
Turkish Data Controllers Registry: Overview
The Data Controllers Registry is a public record that enlists all data controllers registered with KVKK (Kisisel Verileri Koruma Kurumu). This registry is a helpful resource for businesses and individuals requiring to learn about the entities processing their personal data.
Important points to note:
- Recently, the KVKK revised the criteria for exemption from registering with the Data Controllers Registry.
- According to the new criteria, companies with less than 50 employees and an annual financial statement of less than TRY 100 million (approximately $3.7 million) are exempt from the registration requirement as data controllers.
- The amendment takes effect immediately.
