In 2016, Turkey has enacted the Law on Protection of Personal Data (“Law”) based on EU Directive 95/46/EC on protection of individuals with regard to the processing of personal data and on the free movement of such data. The Law requires the data controllers to register with the publicly available registry under the Turkish Data Protection Authority (“DPA”), namely the Data Controller’s Registry (“Registry”).

The registration requirement applies for data controllers located abroad that process personal data in Turkey, as well as Turkish controllers.

On 27 December 2019, DPA announced that the deadline for registration with the Registry is postponed to 30 June 2020. This has been the second extension since the original deadline on 30 September 2019.

The current deadlines for registration with Registry are as follows:

~ 30 June 2020 for data controllers with more than 50 employees or an annual balance sheet total of more than TRY 25,000,000.

~ 30 June 2020 for data controllers domiciled outside Turkey.

~ 30 September 2020 for data controllers engaged in processing of sensitive personal data and with less than 50 employees and annual balance sheet total of less than TRY 25,000,000.

~ 31 December 2020 for governmental institutions and organizations.

In order to meet the registration requirement, data controllers are expected to issue an inventory of data processing and to provide detailed information on their data processing activities such as purpose of data processing, data subject groups, data categories and security measures. Thus, the registration should not be considered as a simple procedural step, but must be approached with diligence among other key actions required for compliance with the data protection legislation. The extension of the deadline is an opportunity for data collectors to finalize their compliance procedures with the Law.

Non-compliance with the registration requirement is subject to an administrative fine of up to TRY 1,800,000 (approx. EUR 280,000.-).