On August 1, 2024, the Personal Data Protection Authority (KVKK) announced that data controllers must comply with the Personal Data Protection Law No. 6698, specifically, Article 16 of the Law, which requires individuals and entities processing personal data to register with and notify the Data Controllers' Registry (VERBIS) before beginning data processing activities.

According to the provisional Article 1 of the Law, the Personal Data Protection Board's decision on March 11, 2021, mandated that all non-exempt data controllers complete their VERBIS registration by December 31, 2021.

Article 18 of the Law states that non-compliance with the VERBIS registration and notification obligations can result in administrative fines ranging from TRY 20,000 (approx. $602) to TRY 1 million (approx. $30,097). The KVKK also noted that public officials and employees of professional organizations with public institution status may face disciplinary actions for violations.

The KVKK highlighted that out of approximately 130,600 identified data controllers, around 16,350 have not fulfilled their registration and notification requirements. As a result, the Board has been conducting VERBIS registration examinations on these non-compliant data controllers and imposing administrative fines based on their annual financial statements.

As of August 1, 2024, the Board has imposed a total of TRY 503,935,000 (approx. $15.2 million) in administrative fines on both domestic and foreign data controllers who failed to meet their obligations. Additionally, disciplinary measures have been enforced on public institutions and professional organizations with public institution status.

You can read the press release, only available in Turkish, here.