Natural and legal persons processing personal data must register with the public Data Controllers' Registry kept by the Presidency before they start processing, unless the Board has exempted them on objective criteria, filing the identity and address of the controller and any representative, the purposes, the data subject groups and data categories, recipients or recipient groups, data envisaged for transfer abroad, the security measures and the maximum retention period, and notifying any change immediately. Under Board decision 2025/1572 (published 1 October 2025) registration is required of controllers in Türkiye with more than 50 employees or annual balance sheet over TRY 100 million, of controllers whose main activity is processing special categories with more than 10 employees or balance sheet over TRY 10 million, and of all foreign controllers processing data of people residing in Türkiye, with named professions and bodies exempt. Breach is fined TRY 20,000 to 1,000,000 (base amount, revalued yearly) under Article 18(1)(ç).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.