On April 28, 2019, certain amendments were made to the Communiqué on the Principles and the Procedures to be followed in the Fulfillment of the Obligation to Inform, the Regulation on Deletion, Destruction and Anonymization of Personal Data and the Regulation on Data Controllers’ Registry.

The amendments in respect to the Communiqué are as follows:

• • The amendment provided a brief and shortened definition for the “Data Controller Registry Information System” (VERBIS) as “the registrar system where the personal data is registered following a structuring in accordance with certain criteria”, to align it with the definition under the Law numbered 6698 on the Protection of Personal Data.

• • The sub paragraph (c) of Article (5), stipulating that in case the personal data is processed in different units of a data controller for different purposes, the obligation to inform must be performed at each unit of the data controller separately, was deleted.

The main changes regarding the Regulation on Data Controllers’ Registry are as follows:

• • Definitions with respect to the “contact person” and the “personal data processing inventory” were revised. In the previous version of the Regulation, a “contact person” definition was used to refer to the legal person data controllers whom will be notified to the Registry of Data Controllers (the “Registry”) by the representative of the data controller. The amendment provided that (i) for the natural and legal person data controllers residing in Turkey, the data controller itself will notify the details of their contact person to the Registry and (ii) for the non-resident natural and legal person data controllers, the representative of the data controller will notify the details of their contact person to the Registry.

• • The scope of the “personal data processing inventory” definition was extended to cover “the legal grounds for personal data process and the maximum storage period for personal data process purposes”, in addition to the personal data process activities, personal data process purposes, data categories, the recipient group, the personal data which will be transferred to abroad and the measures for data security. This amendment was also introduced in the Regulation on Deletion, Destruction and Anonymization of Personal Data published on the same date.

• • Data controllers, required to register to the Registry, are obliged to prepare a personal data processing inventory.

• • Information relating to the contact person are excluded from the list of relevant information that will be provided to the Registry. Therefore, the contact person information will no longer be disclosed to third persons and be publicly available.

• • Under the previous version of the Regulation it was indicated that in case of any changes in the information provided to the Registry, such changes would be notified to the Board within 7 days. The amendment clarified that such period of 7 days will start from the date of the relevant change.

Further to the aforementioned amendments, on April 30, 2019 the Personal Data Protection Authority published a “Guideline for Preparing a Personal Data Processing Inventory” that provides relevant information to the data controllers in performance of their duty regarding the preparation of personal data processing inventory. This guideline refers to several topics such as persons who are obliged to prepare an inventory, content of inventory, stages of inventory preparation and also contains a sample inventory.

This information is provided for your convenience and does not constitute legal advice. It is prepared for the general information of our clients and other interested persons. This should not be acted upon in any specific situation without appropriate legal advice. This information is protected by copyright and may not be reproduced or translated without the prior written permission of Ergün Avukatlık Bürosu.