Registiration Obligation of Liasion Offices in VERBIS

Briefly, Liaison Offices

Foreign businesses located abroad have various options for conducting their business relations in Turkey. Companies established under foreign country laws can either open branches in Turkey or establish a liaison office to conduct their operations. Liaison offices can be defined as places where businesses perform certain necessary or complementary tasks, such as communication, providing contacts, conducting market research, representation, and hosting, in addition to their commercial activities, to achieve their objectives and carry out their operations.

The legal regulation regarding liaison offices is established by Law No. 4875, the “Direct Foreign Investments Law” (“DFIL”), and the “Regulation on the Implementation of the Direct Foreign Investments Law” (“DFIL Regulation”). All expenses for the establishment of liaison offices in Turkey by organizations located abroad are covered with foreign currency to be brought from abroad. Liaison offices are granted activity permits for a maximum of 3 years and can apply for a renewal of the activity permit at the end of this period.

What is Data Controllers and VERBIS, Who Is Obliged to Register with VERBIS?

According to Article 16 of Law No. 6698 on the Protection of Personal Data (“KVKK”), individuals and legal entities, data controllers who process personal data, must register with the “Data Controllers Registry.” This registry is the Data Controllers Registry Information System (“VERBIS”), prepared and provided by the Presidency of the Personal Data Protection Authority.

A data controller refers to a natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system. In determining the data controller, factors such as the method of collecting personal data, the types of personal data to be collected, the purposes for which the collected data will be used, which individuals’ personal data will be collected, whether the collected data will be shared, and if shared, with whom it will be shared, and who makes decisions about how long the data will be stored are taken into account.

With the exception of those exempted by the provisions of the law or by the Personal Data Protection Board (“Board”), individuals and legal entities located in Turkey, as well as individuals and legal entities located abroad who process data in Turkey, are obliged to register with VERBIS.

Verbis Registration Obligation for Liasion Offices

Liaison offices are affiliated with foreign companies located abroad, and they cannot perform any actions outside the orders and instructions of the company. Furthermore, liaison offices do not have a separate legal personality independent of the foreign company. This raises the question of whether liaison offices have a separate data controller status apart from the foreign company. Ultimately, liaison offices engage in data processing activities in Turkey, such as communication, feasibility studies, promotion and advertising, closely monitoring business opportunities in the country, and providing information to the parent company for the purposes of these activities.

The issue of whether legal entities located abroad, their branches, and liaison offices in Turkey bear the title of “data controller” under the Personal Data Protection Law (“KVKK”) and whether they have an obligation to register with VERBIS in this context was addressed by the Personal Data Protection Board (“Board”) in its decision dated July 23, 2019, numbered 2019/225.

In the relevant decision, the Board focused on how legal entities located abroad maintain their presence in Turkey. As a result of the assessments made in this context, the Board first determined that data controllers located abroad who engage in personal data processing activities directly or through their branches in Turkey are obligated to register with the Data Controllers Registry. Regarding the branches located in Turkey, if they meet the definition of “data controller” as stipulated in the KVKK, they will be considered as separate data controllers established in Turkey apart from the legal entity located abroad. However, it was determined that liaison offices do not have an obligation to register with VERBIS separately from the data controller located abroad.

Although the decision of the Board stated that liaison offices do not need to register with VERBIS, this issue was explained only by comparing it to branches and was not sufficiently justified. Furthermore, the said decision did not clarify the status of foreign companies that have only liaison offices or representations in Turkey and process data through their presence in Turkey.

In another decision dated June 23, 2020, numbered 2020/471, the Board explained the VERBIS registration obligation concerning a foreign bank located abroad and its representation in Turkey. The activities of foreign banks’ representations in Turkey are regulated by the Regulation on the Principles and Procedures Regarding the Activities of Branches Opened in Turkey. These representations conduct activities on behalf of their affiliated banks, such as promoting the bank and its services, conducting market research, and reporting collected information to the headquarters. In this sense, foreign bank representations carry out activities similar in nature to liaison offices. Additionally, just like liaison offices cannot engage in commercial activities, foreign bank representations in Turkey are also unable to perform certain activities stipulated in the Banking Law.

In the mentioned decision, it was emphasized that even though a foreign bank is located abroad and conducts data processing activities abroad, the representation of the foreign bank has a continuous presence in Turkey. The Board, therefore, established a connection between the activities of the representation and the personal data processing activities of the foreign bank. Consequently, the foreign bank located abroad is considered a data controller and, accordingly, has an obligation to register with VERBIS due to its representation in Turkey.

It is understood that a foreign legal entity with a continuous presence in Turkey through its liaison office will be considered a data controller in this context and is obliged to register with VERBIS. In contrast, the liaison office itself will not have a direct obligation to register with VERBIS. The Regulation on the Data Controllers’ Registry stipulates that non-resident data controllers are required to register with the Registry through their “representatives” before commencing personal data processing. Accordingly, foreign legal entities located abroad must first appoint a “data controller representative” and submit the approved document related to this appointment to the Personal Data Protection Authority with a wet signature during the registration application process. In cases involving a liaison office, it would be appropriate for the head of the liaison office to serve as the data controller representative. The “decision on the appointment of the data controller representative” to be taken by the competent body of the foreign company and its minimum content are regulated in Article 11/3 of the Regulation on the Data Controllers’ Registry as follows:

“The decision to appoint a data controller representative shall be prepared to cover, at a minimum, the following matters:

Accepting service of notifications or correspondence made by the Authority on behalf of the data controller,
Conveying requests addressed to the data controller by the Authority to the data controller and transmitting the response to the Authority that will be received from the data controller,
Receiving and forwarding, on behalf of the data controller, applications that data subjects will address to the data controller pursuant to the first paragraph of Article 13 of the Law and transmitting them to the data controller, unless otherwise determined by the Board,
Transmitting, on behalf of the data controller, responses of the data controller to data subjects in accordance with the third paragraph of Article 13 of the Law, unless otherwise determined by the Board,
Carrying out procedures and transactions regarding the Registry on behalf of the data controller.”

Regarding the implementation of the Personal Data Protection Law (KVKK), all communication between the data controller and the Personal Data Protection Authority (Kurum) will be conducted through the data controller representative for non-resident data controllers in Turkey. The data controller representative will appoint a “contact person,” either within or outside their organization. This contact person must be a natural person residing in Turkey and a Turkish Republic citizen.

Conclusion

Non-resident organizations have various ways to establish a presence and conduct data processing activities in Turkey. These companies can process data directly in Turkey or maintain their presence and engage in personal data processing activities through branches. However, these companies may have limited presence in Turkey, such as representative or liaison offices, which is more limited than a branch.
If non-resident legal entities in Turkey, whether they have liaison offices or branches, engage in data processing activities and are considered data controllers in terms of KVKK, they will have an obligation to register with VERBIS.
Although the branches of the foreign headquarters in Turkey do not have a separate legal personality, they will be considered data controllers and subject to the obligations arising from this status.
On the other hand, liaison offices in Turkey do not have an obligation to register with VERBIS separately. However, if the headquarters company is considered a data controller in terms of KVKK and has an obligation to register with VERBIS, certain procedures and applications related to VERBIS on behalf of the company will need to be carried out by the liaison office.