Regulation on the Data Controllers Registry (Veri Sorumluları Sicili Hakkında Yönetmelik)

Overview

The Regulation on the Data Controllers Registry was issued by the Personal Data Protection Authority (KVKK) and published in Official Gazette 30286 of 30.12.2017. It sets up and governs the public Data Controllers Registry (VERBİS), kept by the Authority under Board supervision. It forms the implementing framework for the registry duty provided for in Article 16 of Law No. 6698.

The regulation lists what the registration contains: details of the controller, its representative and contact person, the purposes of processing, data subject groups and data categories, recipient groups, transfers abroad, security measures taken, and the maximum retention period. This list shows what an organisation's data processing inventory needs to cover in practice.

Controllers fulfil the registration duty by uploading the required information to VERBİS. For legal persons, the controller is the legal entity itself. The regulation also sets out how entries are to be kept up to date.

As a limitation, this summary rests only on the recorded articles; detail such as exemption criteria, deadlines and administrative sanctions is not covered here.

Key points

1. Purpose: setting up and running the public Data Controllers Registry under KVKK (Article 1).
2. The registration contains controller, representative and contact details, processing purposes, data subject groups and categories, recipients, foreign transfers, security measures and maximum retention (Article 9).
3. Controllers fulfil the registration duty by uploading the required information to VERBİS (Article 10).
4. For legal persons the controller is the legal entity itself (Article 11).
5. The registry is kept by the Authority under Board supervision.
6. The regulation also covers keeping entries up to date.

Using it in design

• For customers who self-host SoSo CAD, generate a VERBİS-ready inventory (purposes, data categories, recipients, foreign transfers, security measures) from the product's data-processing configuration.
• Expose retention periods as an explicitly definable field in configuration.
• Make third-party and foreign services that receive data traceable in configuration.

Who should read it

Data centre and software operators processing personal data, compliance officers and legal counsel.

Related standards

• 6698 sayılı Kanun Madde 16
• Kişisel Verilerin Silinmesi, Yok Edilmesi veya Anonim Hale Getirilmesi Hakkında Yönetmelik

Publication details

Authors

Kişisel Verileri Koruma Kurumu (KVKK)

Publisher

Kişisel Verileri Koruma Kurumu (KVKK)

Year

2017

Document number

RG 30286 (30.12.2017)

Document language

Turkish

Source type

Turkish regulation

Access

Free to read

Licence

Bibliographic reference only — the document is not redistributed here; confirm reuse terms at the original source

Citation