Who must register in the data controllers' registry? Decide with three tests

Who has to register with the data controllers' registry?

Three criteria decide the obligation, and they are alternatives to one another: meeting one is enough. An employee count threshold, a balance sheet total threshold, and having the processing of special category personal data as your main activity. Meeting none of the three means no registration obligation.

In practice the "alternative" relationship is what gets confused most. A company with few employees can be obliged because it crosses the balance sheet threshold; a health technology startup crossing neither becomes obliged through the third test. Looking at one test and concluding "we are out of scope" is the most common and most expensive mistake.

What are the employee and balance sheet thresholds?

Because they change. Registration exemption thresholds are updated by board decisions, and most of the Turkish content online still carries a figure from several years ago — a company concluding "we are out of scope" against that figure is breaching its obligation without knowing it.

What is durable is the logic of the tests: three criteria, an alternative relationship, no threshold for special category data. Confirm the figure in force on the authority's own page along with the decision date, and keep that confirmation in your registration file. What an audit asks is how you knew the number.

If we are exempt from registering, are we exempt from the law?

Almost nothing. The registry is a register, not the law itself. A company below the threshold is equally obliged to meet its duty to inform, to obtain consent where consent is required, to apply technical and administrative measures, to set retention periods and delete once they pass, and to notify a data breach within the deadline.

The typical scenario in companies that miss this distinction: nothing is done because there is no registration obligation, then a breach happens and the audit finds neither an inventory, nor a privacy notice, nor a record of measures. What produces the penalty is not the absence of the registration but the absence of those.

How do you build a personal data processing inventory?

Every field the registry form asks for — data categories, processing purposes, lawful bases, recipient groups, retention periods, cross-border transfers — comes from the personal data processing inventory. A company without one can only fill the form by guessing, and that guess becomes evidence against it in every later audit.

The practical way to build an inventory is to work from the systems: which software holds personal data, which fields each one has, where the data comes from and where it goes. HR, accounting, CRM, e-commerce, the support system and camera recordings come out near the top of the list in almost every company.

Does a foreign company have to register?

Data controllers not established in the country fall under a different regime: they must appoint a representative and register through them. A subsidiary of a foreign group is assessed on its own legal personality — a group registration does not remove the subsidiary's obligation.

How long does registration take?

The registration itself is an hour's work. What sets the timeline is the inventory: a few days in a company with few systems, weeks in an organisation with many. The right order is inventory, privacy notices, retention and destruction policy, then registration; the reverse order speeds up the registration and makes its content wrong.

Is registration free?

Registration is free and done directly through the authority's own system. Intermediaries charging a fee are selling the preparation rather than the registration: building the inventory, privacy notices, retention and destruction policy. That work genuinely takes effort, but you do not have to pay for the registration itself. If you work with an intermediary, ask for the pricing line by line.

Are a privacy notice and consent the same thing?

No, and confusing them is one of the more expensive mistakes. A notice is an information duty; it applies to every processing and needs no approval. Consent is a lawful basis; it is only needed when no other basis applies. Companies collecting consent for everything have to stop processing when consent is withdrawn — even where a contract or legitimate interest would have sufficed.

Does employee data need registering too?

It has to appear in the inventory, yes. HR data is the largest set of personal data in almost every company: personnel files, payroll, leave records, medical certificates, camera recordings. Holding a medical certificate does not by itself bring the company into the special category scope, but it has to appear as its own category in the inventory with a defined retention period.

Who should do the registration?

Whoever technically enters it, the responsibility sits with the data controller — the company. In practice the person running it is usually legal, compliance or IT; what matters is that the people who actually know what is in the inventory contribute. A record filled in by one person from guesswork does not hold up when compared against the systems in an audit.

“The registry is a register, not the law itself; exemption from registering is not exemption from the obligations.”