Turkish Data Protection Authority Started Enforcement Against Foreign Controllers

Recently, the Turkish Data Protection Authority (“DPA”) started sending information request letters dated August 15, 2022, to foreign controllers (data controllers located outside Turkey but collect/process personal data from Turkey) that did not register with the Data Controllers’ Registry (“VERBIS”) by the deadline.

For background, all foreign controllers that collect data from Turkey are required to; i) appoint a local representative in Turkey and ii) register with VERBIS. The