Replacing a Foreign Company’s Turkish Data Controller Representative: VERBIS and Continuity

Identify exactly what is changing

The starting point is the identity of the data controller. Article 3 of Law No. 6698 defines the controller by its decisions about processing purposes and means and its responsibility for the data filing system. Replacing a service provider in Turkey does not, by itself, transfer those decisions to that provider. The foreign legal entity must therefore identify whether it is replacing its representative, changing only its contact person, or transferring an actual business and processing operation to another controller. These events require different records and legal analysis.

The distinction between representative and contact person is explicit in Article 11(4) of the Data Controllers Registry Regulation. The contact person entered in the registry does not acquire authority to represent the controller under the Law and Regulation merely through that entry. A change of employee operating an account is consequently insufficient evidence that the foreign company’s legally appointed representative has changed. Conversely, a new representative does not establish a new foreign controller or erase the old controller’s history.

Document the current legal entity, existing representative, notified contact person and relevant appointment decision before changing an account. The company’s registered name and identifying documents should agree across the appointment, registry and correspondence. A group brand or trading name is not a substitute for identifying the entity responsible for the processing. Our guide to VERBIS registration by foreign controllers explains the underlying appointment obligation; the issue here is preserving that arrangement when the appointed person changes.

Prepare the replacement appointment

Article 4(1)(p) of the Registry Regulation defines the representative as a legal person established in Turkey or a natural person who is a Turkish citizen, authorised at least for the matters in Article 11(3). The Authority’s Decision No. 2020/542 also expressly describes a natural-person representative as a Turkish citizen resident in Turkey. Verify the replacement’s residence as well as citizenship.

The appointment must come from the foreign controller’s competent organ or person. Article 11(2) requires a certified copy of that decision to be submitted to the Authority by the representative at registration. A replacement file should likewise establish the competent decision, its effective date and the new representative’s authority, rather than relying solely on an invoice or an informal instruction to change contact details.

The minimum mandate has five functions: accepting Authority notifications and correspondence for the controller; forwarding Authority requests to the controller and returning its responses; receiving and forwarding Article 13 applications unless the Board sets another procedure; conveying the controller’s responses to applicants on the same basis; and conducting registry operations for the controller. A service agreement that excludes receipt of official correspondence cannot replace an appointment containing the minimum powers required by Article 11(3).

The corporate decision and the commercial engagement should be consistent but perform different work. The decision establishes the relevant representative authority. The engagement can allocate staffing, translation, document handling, escalation contacts and responsibility for service fees. Neither document can contract away the foreign controller’s statutory duties. Verify the signatory’s corporate authority and the certification requirements applicable to the actual document; the Registry Regulation does not justify treating every document from every foreign jurisdiction as subject to an identical authentication route.

Update VERBIS within the legal period

Article 16(4) of Law No. 6698 requires changes to the information listed in Article 16(3) to be notified immediately to the Presidency. Article 13 of the Registry Regulation supplies the specific registry update rule: changes in registered information must be notified through VERBIS within seven days from the date the change occurs. The provision says seven days, not seven business days. Preparing documents early and submitting promptly respects both the statutory requirement and the regulation’s express deadline.

The file should identify the event that changed the registered information and its actual date. A decision signed on one date with an expressly later effective date must be read according to its terms and the applicable corporate arrangements. An uncertain or disputed termination requires legal assessment; it should not be concealed by selecting an arbitrary later date in an internal spreadsheet. Preserve the operative decision, termination communication, replacement acceptance and submission record so the chronology can be established from documents.

Changing the representative can also require correction of the notified contact person, address and correspondence details. Review the fields actually affected, while preserving accurate information about the controller’s processing activities. Article 5(1)(e) makes the controller responsible for complete, accurate, current and lawful information supplied to and published in the registry. A screenshot showing an edited form is weaker evidence than the completed submission and the resulting record. Retain both the submission confirmation and a dated check of the registry information after the update.

Preserve the official communication route

Article 12(1)(c) of the Registry Regulation provides that the Authority’s communications with a controller not established in Turkey take place through the representative notified in the registry. This makes continuity of receipt a legal issue. The foreign company’s headquarters should know who is monitoring the notified route during the transition, who can recognise an official request and who is responsible for escalating it to the person able to produce the answer.

The appointment’s effective dates, the registry update and practical access to correspondence should be coordinated. A commercial termination email does not establish that every official channel already reflects the replacement. The controller should examine messages received around the transition and preserve their delivery records. Whether an individual notification was legally effective depends on the applicable service rules and the actual evidence; a representative change alone does not establish invalid service or a fresh response period.

The replacement arrangement should provide a secure method for forwarding material that arrives at the former representative after the handover. That operational instruction must respect the parties’ authority and the confidentiality of the correspondence. It is not an authorisation for indefinite access to all company systems. A reliable handover records which channels have been transferred, which have been closed and how residual incoming communications will reach the controller. This supports the minimum receipt and forwarding functions that Article 11(3) already requires.

Transfer pending requests and investigations

Article 13(2) of Law No. 6698 requires the controller to conclude a data subject’s application as soon as possible according to its nature and within thirty days at the latest. The applicant’s rights are directed to the controller. Substituting the representative does not create a statutory extension. The handover must therefore identify the original application date, its contents, identity checks already performed, information still needed and any answer already sent.

A Board investigation has a separate timetable. Under Article 15(3), the controller must send the requested information and documents concerning the investigation within fifteen days, except material constituting a state secret, and permit an on-site examination where necessary. Article 15(5) separately requires a Board decision ordering the correction of unlawfulness to be implemented without delay and no later than thirty days after service. A file labelled simply “KVKK correspondence” obscures these different legal duties.

For each open matter, retain the original communication and evidence of receipt, the legal provision governing the response, the responsible decision-maker and the actual submission record. A request that has been acknowledged but not answered must remain open. A response sent to headquarters is not the same event as a response sent to the Authority or applicant. The incoming representative needs enough history to avoid inconsistent statements and duplicated disclosures, while the controller must continue making the substantive decisions for which it is responsible.

Control the records and access handover

The handover commonly involves personal data in applications, identity documents, incident records and correspondence. Article 12(1) requires appropriate technical and organisational measures against unlawful processing and access and for the protection of personal data. Article 4 requires processing to remain relevant, limited and proportionate to its purposes. These obligations favour a defined transfer of the material needed to perform the appointment, accompanied by an inventory, rather than unrestricted copying of an entire shared drive.

Separate records the controller must retain from unnecessary duplicates held by the outgoing provider. Record the transfer method, authorised recipients, access controls and confirmation of receipt. Access granted for the former appointment should be reviewed against the continuing legal and contractual role, and unnecessary permissions withdrawn. These are practical measures for implementing Article 12; they are not a statutory claim that every representative change must use one named software product or identical technical design.

Article 12(4) prohibits controllers and processors from disclosing personal data contrary to the Law or using it outside the processing purpose, and states that this obligation continues after they leave their duties. Contract termination therefore does not turn the contents of the compliance file into unrestricted material. Retention and deletion must also respect Article 7 and any genuine continuing legal grounds. A blanket instruction to destroy everything can undermine a required record, while indefinite retention without a continuing basis creates a different compliance problem.

Correct public information and transfer arrangements

Article 10 of Law No. 6698 requires information about the controller and, where applicable, its representative to be provided when personal data are obtained. A representative change should therefore trigger a review of the notices and application channels in which the former representative is identified. The notice must continue to provide an accurate route to the actual controller and the information required by Article 10, including purposes, recipients, collection method and legal basis, and the rights under Article 11.

The replacement also needs a practical understanding of the controller’s current processing inventory. Under Article 5(1)(ç) of the Registry Regulation, controllers required to register must prepare a personal data processing inventory, and registry information is based on it. The incoming representative should be supplied with the current approved information and the person responsible for maintaining it. Copying an old registry entry without checking notified changes does not establish that the controller’s continuing accuracy duty has been met.

Access from foreign headquarters raises a separate question. Representative appointment and VERBIS registration are not safeguards for an overseas transfer under Article 9. Review the actual recipient, location, purpose and applicable transfer basis before moving handover records outside Turkey or making them accessible abroad. The Article 9 transfer framework and standard contracts address that separate issue. The appointment should not describe itself as authorising all international disclosures merely because the controller is based overseas.

Separate replacement from registry erasure

Article 14 of the Registry Regulation addresses erasure of a registry entry. The controller applies through VERBIS, and erasure follows when the activity requiring registration ceases or disappears. Replacing the person performing the representative function does not itself establish that condition. The relevant question is whether the foreign controller’s activity requiring registration has ended, not whether its relationship with one Turkish service provider has ended.

The distinction matters when a business announces withdrawal from Turkey while retaining personal data or continuing another processing activity. The controller must examine the activity and the applicable registration rules before requesting erasure. Article 14(2) also provides that erased records are retained in an accessible but unalterable form. Erasure consequently does not mean that the historical registry information vanishes or that the company can rewrite its previous representation history.

Article 14(3) expressly preserves obligations arising during the period of registration. Outstanding applications, an existing investigation and the lawfulness of earlier processing therefore require separate treatment. A termination project should identify both the registry outcome and the continuing responsibilities. This prevents the commercial end of the representative engagement from being treated as proof that the controller no longer has duties under the Law.

Resolve disputed termination and retain evidence

A dispute over unpaid fees, access or the effective termination date should be separated into its contractual and regulatory issues. The representation agreement and appointment documents determine the evidence available about the parties’ commitments and authority. The Registry Regulation determines the required representative functions, communication arrangements and notification of changed information. A contractual disagreement does not itself suspend the controller’s obligations under Articles 13, 15 or 16.

The final transition file should establish who was authorised at each relevant date, what information changed, when VERBIS was updated and where pending matters were transferred. Keep the appointment and termination documents, accepted handover list, official correspondence, submission confirmations and the record of access changes. These documents allow a later reviewer to distinguish an operational delay from a substantive failure to respond and identify the party responsible for a particular step.

Law No. 6698 Article 18 provides administrative sanctions for breaches including registry notification obligations and failures concerning Board decisions. The applicable sanction requires assessment of the particular duty and facts; it is not established merely by the existence of a provider dispute. A properly evidenced replacement keeps the controller’s legal identity, representation, public information and pending compliance work aligned throughout the transition.

Frequently asked questions

1. Does changing the representative create a new data controller?

No. The controller is identified under Article 3 by its role in determining processing purposes and means. A representative change normally changes the local representative arrangement, while the foreign legal entity remains the controller. A business transfer must be analysed separately.

2. Is the VERBIS update period seven business days?

Article 13 of the Registry Regulation says seven days from the change. It does not describe that period as business days. Article 16(4) of Law No. 6698 also requires changed information to be notified immediately.

3. Can the contact person replace the appointed representative?

The contact person’s registry entry does not itself confer representative authority. Article 11(4) expressly distinguishes the roles. The foreign controller needs a valid appointment covering the minimum powers in Article 11(3).

4. Can the new representative refuse to receive Authority correspondence?

The required appointment includes acceptance of Authority notifications and correspondence for the controller. An arrangement that excludes this minimum function is inconsistent with Article 11(3)(a). Commercial service terms must accommodate the statutory mandate.

5. Does a pending data subject request start again after replacement?

No new period arises merely because the representative changes. The controller’s Article 13 obligation remains tied to the existing application, which must be concluded as soon as its nature permits and within thirty days at the latest.

6. Is a Board information request subject to the same thirty-day period?

No. Article 15(3) provides fifteen days for requested investigation information and documents, subject to its state-secret exception. Article 15(5) governs the separate implementation of a remedial Board decision without delay and within thirty days after service.

7. Must all old representative records be destroyed immediately?

No universal immediate-destruction rule follows from replacement. Examine the processing purpose, retention duties and any continuing lawful basis. Unnecessary access and copies must be addressed, while records that remain lawfully required must be preserved securely.

8. Does VERBIS registration authorise a handover to foreign headquarters?

No. A transfer abroad must satisfy the applicable Article 9 requirements. Registration and appointment address different duties. Identify the actual data, recipient and access arrangement before selecting the overseas transfer mechanism.

9. Can the company erase its registry entry because its representative resigns?

Resignation alone does not satisfy Article 14. Registry erasure concerns the end or disappearance of the activity requiring registration. Historical obligations remain even when a registry entry is properly erased.

10. Which documents prove a completed replacement?

The relevant evidence includes the competent appointment decision, termination record, effective dates, VERBIS submission and resulting entry, pending-file handover and access changes. The exact documents depend on the actual appointment and the matters already in progress.