Turkiye: Implemented Decision 2023/1154 establishing exception criteria regarding the obligation to register in the Data Controllers Registry

On 25 July 2023, the Personal Data Protection Authority of Turkiye (KVKK) Decision 2023/1154, establishing exception criteria regarding the obligation to register in the Data Controllers Registry, entered into force. The Decision was adopted in accordance with the Law on Protection of Personal Data No. 6698, which empowers the KVKK to establish exceptions to the registration requirement and define the scope and implementation of such exceptions. The KVKK stated that it is updated the registration requirements based on the new legal definition of small and medium-sized enterprises. In particular, entities with less than 50 employees whose annual revenue does not exceed TRY 100 million and whose main activity does not involve processing sensitive personal data are exempted from registering as a data controller.