According to latest decision rendered by KVKK (Personal Data Protection Authority), representative offices in Turkey of foreign companies are exempt from obligation of registration in VERBIS (Registry of Data Controllers), whereas foreign companies’ branch offices in Turkey are regarded as a separate legal person in terms of VERBIS registration.

Upon a clarification request, KVKK opined that;

• Branch offices in Turkey of foreign companies are required to register in VERBIS provided that other conditions under personal data legislations are met.

The confusion here was that data controller which is obliged to register in VERBIS must be a natural or legal person according to personal data legislation in Turkey, whereas a branch office cannot be considered as a legal person nor a natural person rather a part of legal person according to Turkish law. However, branch offices are using various personal data during their business operation. Therefore, in order to avoid the misuse of loophole in law, referring to different legislation in Turkish law and GDPR, KVKK has rendered this decision and obliged the branch offices to register in VERBIS under the same conditions that apply to legal person.

• Representative offices in Turkey of foreign companies are not under obligation to register in VERBIS.

Since the representative offices are not allowed to conduct commercial activities rather to conduct some feasibility or socio-economic studies in Turkey and arrange communication between related companies, KVKK has decided to exclude representative office from obligation to register in VERBIS.

For more info: https://kvkk.gov.tr/Icerik/5545/2019-225