What You Need to Know About KVKK: VERBIS Registration Requirement and Penalties

The protection of personal data has become increasingly important in today's world. In Turkey, the Personal Data Protection Law No. 6698 (KVKK) regulates the processing and protection of personal data. In this article, we will provide detailed information on the VERBIS (Data Controllers’ Registry Information System) registration requirement under KVKK and the penalties for non-compliance.

What is KVKK and VERBIS?

KVKK is a law that includes regulations on the processing and protection of personal data. The purpose of this law is to ensure the lawful processing of personal data, maintain the privacy of personal data, and protect individuals' privacy. Under KVKK, data controllers are subject to certain obligations.

VERBIS is a registry system where data controllers are required to register their personal data processing activities. This system is managed by the Personal Data Protection Authority and requires data controllers to declare how they process personal data.

VERBIS Registration Requirement

Under KVKK, data controllers are required to register with VERBIS within a specified period. The registration requirement varies based on the size of the data controller, the field of activity, and the type of data processed. Generally, data controllers with more than 50 employees annually or an annual financial balance of more than 25 million TL are required to register with VERBIS.

Data controllers should follow these steps for VERBIS registration:

1. Pre-Registration: Pre-registration must be done through the Personal Data Protection Authority's website.

2. Entering Registration Information: Data controllers must enter information about the types of data processed, the purposes of processing, data subjects, and retention periods into the system.

3. Declaration Approval: A declaration confirming that the information entered is correct and complete must be approved.

Penalties for Non-Compliance with VERBIS Registration Requirement

KVKK prescribes various penalties for non-compliance with the VERBIS registration requirement. These penalties include both administrative fines and other legal sanctions:

1. Administrative Fines: Data controllers who fail to fulfill the VERBIS registration obligation may be subject to administrative fines ranging from 20,000 TL to 1,000,000 TL by the Personal Data Protection Authority.

2. Right to File a Lawsuit: Individuals whose personal data is processed have the right to file a lawsuit if data controllers fail to fulfill their obligations. In such cases, data controllers may face legal liability.

3. Suspension of Processing Activities: The Personal Data Protection Authority may decide to suspend personal data processing activities if deemed necessary. This could result in significant business losses and reputational damage for data controllers.

Conclusion

KVKK and the VERBIS registration requirement are crucial for the protection and lawful processing of personal data. Data controllers must fulfill these obligations to avoid both administrative fines and legal sanctions. At KOÇAK LAW, we provide professional consultancy services on KVKK compliance and VERBIS registration processes. For more information and support, please contact us.