Data Controllers Registry

I. Characteristics of the Data Controllers Registry

The law mandates that data controllers must register in the Data Controllers Registry, which is kept by the Presidency under the supervision of the Board. Therefore, it is aimed to disclose who the data controllers are to the public and to enable a more effective exercise of the right to personal data protection through this method. The procedures and principles regarding the registry are determined in the Regulation on the Data Controllers Registry.

The Data Controllers Registry must be kept publicly accessible within the scope of the Law. The concept of public accessibility means that anyone who wishes can examine the registry. The principle of public accessibility is important in terms of personal data protection. Since data controllers being known by the public will allow the relevant persons to more effectively fight against rights violations.

As a rule, all data controllers are required to register in the Data Controllers Registry. This registration process must be completed before starting data processing activities. However, in cases listed in the second paragraph of Article 28 of the Law, the provisions of Article 16 regulating the obligation to register in the Data Controllers Registry will not apply. Additionally, the Board has been granted the authority to exempt from the registration obligation. Accordingly, the Board has determined these criteria, which are listed in the Regulation on the Data Controllers Registry published in the Official Gazette dated 30.12.2017.

II. Obligation to Register in the Data Controllers Registry and Exceptions

The said criteria are:

  • The nature of the personal data.
  • The quantity of personal data.
  • The purpose of processing the personal data.
  • The field of activity in which the personal data is processed.
  • The situation of transferring personal data to third parties.
  • Whether the personal data processing activity arises from laws.
  • The duration of retention of personal data.
  • The group of data subjects or data categories.

III. Registration Notification to the Data Controllers Registry

Application for registration in the Data Controllers Registry shall be made with a notification containing the following information. These are:

  • Identity and address information of the data controller and, if any, its representative,
  • The purpose for which personal data will be processed,
  • Explanations about the group or groups of data subjects and the data categories belonging to these persons,
  • Recipients or recipient groups to whom personal data may be transferred,
  • Personal data envisaged to be transferred to foreign countries,
  • Measures taken regarding personal data security,
  • The maximum duration necessary for the purposes for which personal data is processed.

If there is any change in the information listed above, these changes must be immediately notified to the Institution. Thus, it is aimed to ensure the registry's up-to-dateness.

Contact:
Nasuh Akar Mah. 1407. Sokak No:4 06520 Balgat-Çankaya/Ankara
www.kvkk.gov.tr
Tel: 0 (312) 216 50 50
Fax: 0 (312) 216 50 52