Data Controller Contact Person

The data controller contact person is the natural person notified by legal entity data controllers registering with the Data Controllers’ Registry (VERBİS) to handle data subject applications and communications with the Personal Data Protection Authority. The role is governed by the Regulation on the Data Controllers’ Registry.

What the Role Is, and What It Is Not

The contact person is a point of contact. They route data subject applications and correspondence from the Authority to the right unit within the company and help track deadlines. They have no authority to represent the company or take decisions on its behalf, and no personal responsibility for KVKK compliance. Obligations and sanctions are always addressed to the data controller.

Whom to Appoint

Missing a letter from the Authority or a data subject application means missing short deadlines: data subject applications must be answered within thirty days, and requests for information and documents from the Board within fifteen days. The contact person should therefore be someone who can recognise applications, quickly reach the legal and IT functions, and has a designated deputy. When the contact person changes, the VERBİS record must be updated.

How It Differs from Similar Roles

• Data controller representative: A legal entity established in Turkey or a Turkish citizen appointed by data controllers not established in Turkey for VERBİS registration, representing the controller before the Authority. The representative also designates a contact person.
• Data protection officer (DPO): A compliance officer with guarantees of independence, mandatory in certain cases for companies subject to the GDPR. There is no such requirement under the KVKK; see Data Protection Officer.