Two new announcements have recently been made on the official website of the Data Protection Authority (www.kvkk.gov.tr) re. (i) Decision No. 2018/32 of Personal Data Protection Board on “data controllers who will be exempted from the requirement to register with the Data Controllers Registry” and, (ii) minimum content requirements of the undertakings to be prepared by the data controllers for transfer of personal data to third countries which do not have adequate level of data protection.
This Legal Alert aims at providing you with an overview on recent Decision No. 2018/32 of Personal Data Protection Board (“Board”) on “data controllers who will be exempted from the requirement to register with the Data Controllers Registry” which was published in the Official Gazette numbered 30422 and dated May 15, 2018 (“New Decision”).

Please note that this Legal Alert is intended to be general information purposes only. No statement herein contains any opinion or professional legal advice.

I. GENERAL OVERVIEW

Before elaborating on the provisions of the New Decision, we would like to briefly touch upon the general registration requirement as introduced under Article 16 of the Law on Personal Data Protection numbered 6698 and dated March 24, 2016 (the “Law”). As per Article 16 of the Law, the Data Protection Authority, under the supervision of the Data Protection Board, shall keep Data Controllers Registry to be publicly available. Data controllers are required to be registered with the Data Controllers Registry. However, the Data Protection Board can grant exemption from the registration requirement for certain data controllers.

The term “data controller” is defined as the real or legal person which determines purposes and means of processing of personal data and is responsible for the setup and management of the data recording system. Considering the broad nature of this definition, a significant majority of real and legal persons having business affairs in Turkey are very likely to qualify as data controllers within the context of the Law and accordingly will be required to register with the Data Controllers Registry, unless they fall under the scope of the exemptions to be introduced by Data Protection Board. Further, according to Provisional Article 1 of the Law, data controllers shall register with the Data Controllers Registry until the date determined and announced by the Board.

In the New Decision, the Board has announced the data controllers who will be exempt from the registration requirement. However, the date for registration has not been determined and announced by the Data Protection Board yet.

II. DATA CONTROLLERS WHO ARE EXEMPT FROM THE REQUIREMENT TO REGISTER WITH THE DATA CONTROLLERS REGISTRY

In the New Decision which has been published on May 15, 2018, it has been set out that the following data controllers will be exempted from the registration requirement:

1. Data controllers who process personal data solely by non-automatic means provided that it constitutes any part of a data recording system.
2. Notary publics operating pursuant to the Notary Public Law dated 18/01/1972 and numbered 1512.
3. Amongst the associations established in accordance with the Associations Law dated 04/11/2004 and numbered 5253, foundations established in accordance with the Foundations Law dated 20/02/2008 and numbered 5737 and unions established in accordance with the Law On Unions And Collective Labour Contracts dated 18/10/2012 and numbered 6356, only those which are processing personal data in accordance with the relevant legislation and purposes thereof, limited to its field of activity and only relating to their own employees, members, associates and donators.
4. Political parties which are established pursuant to the Political Parties Law dated 22/04/1983 and numbered 2820.
5. Lawyers operating pursuant to the Attorneys’ Law dated 19/03/1969 and numbered 1136.
6. Independent certified public accountants and sworn-in certified public accountants operating pursuant to the Independent Certified Public Accountants and Sworn Certified Public Accountants Law dated 01/06/1989 and numbered 3568.