ERDEM-NEWSLETTER-2018-metin

339 PERSONAL DATA PROTECTION process personal data. Likewise, according to Article 8 of the Regula- tion on the Data Controllers Registry (“Regulation”), which is stipu- lated and based on the same provision of the law, to determine and provide the application of the rules and procedures as to the formation of the Data Controllers Registry that will be kept by the Chairmanship, publicly, pursuant to the Law under the surveillance of the Board, and its administrations and the registration that will be made to the Reg- istry, the data controllers must fulfill their obligation to the Registry before starting to process personal data. According to these provisions, the data controllers that are not under obligation to register, but are obligated to register later on, shall file with the Registry within the thirty days following the date they became obligated. In the event that the Data Controllers who are under obligation to register cannot fulfill their registration obligations due to a factual, technical, or legal impossibility, they shall apply to the Authority with- in 7 working days following the date when this impossibility arose, provided that they apply in writing, and with justification; and they may demand additional time. The Authority, one time only, may grant additional time, provided that it does not exceed thirty days. The Exceptions to the Obligation of Registration As mentioned, above, the data controllers must fulfill their obliga- tions as to filing with the Registry, prior to the processing of personal data. Be that as it may, pursuant to Article 16 of the Law, the Board may allow exceptions to this obligation, by considering the objective criteria to be determined by the Board, such as the qualification of the personal data, its number, whether the processing derives from the law or transfer of the personal data to third parties. The provisions, below, are stipulated under Article 16 of the Regulation, as well: “ The Board may bring exceptions to the registration obligation by way of considering the criteria below: a) The qualification of the personal data;