In the Public Announcement on Registration in the Data Controllers Registry dated 04.01.2022 published by the Personal Data Protection Authority (KVKK), the Authority has stated some matters which are evaluated within the Article 5 “Data controllers are responsible for ensuring that the information submitted to the Registry and published in the Registry is complete, accurate, up-to-date and in compliance with the law,” and Article 9 “The registration application made to the Registry shall contain information on the information in the application form, the purpose of processing personal data, the groups of persons who are the subject of the data, the recipient groups to which the personal data is transferred, whether transfer to foreign countries is foreseen, the data security measures taken and the retention periods.” of the Regulation on the Data Controllers Registry.
Within the scope of the specified provisions, according to the evaluation made in the announcement, the obligation to register and notify to VERBIS is not fulfilled by simply entering the registration application form into the system or by sending it to the Institution by mail, cargo, courier, KEP or hand-delivered. In order to fulfil the registration and notification obligation, after these transactions are approved by the Authority, assignment of a “contact person” by logging in via the “username” and “password” sent to the e-mail address specified in the application form, and the “Data Controller Manager Login” button on the VERBIS homepage should be made, and also the appointed contact person must log in via the “Register to the Registry” button on the VERBIS main page, and a “notification” must be issued for the relevant data controller and the notification must be approved on the system.
As stated in the continuation of the relevant announcement, missing applications and notifications to VERBIS must be completed as soon as possible through the system that allows editing and can be accessed uninterruptedly. Apart from this, according to Article 13 of the Regulation, changes in the information registered in the Registry are notified to the Authority via VERBIS by the data controllers within seven days from the date of the change. In accordance with this provision, it is possible to make notification update via VERBIS.
As stated last in the announcement, apart from registering to VERBIS, there are other obligations under the Law and secondary legislation, and data controllers must comply with other obligations as well.