(1) The Board may provide derogation from registration obligation by considering following criteria:

• a) The nature of personal data.
• b) The quantity of personal data.
• c) The purpose of processing of personal data.
• ç) The field of activity where personal data are processed.
• d) Transferring personal data to third parties.
• e) The fact that the processing of data is laid down in the laws.
• f) Storage period of personal data.
• g) Group of persons subject to the data or categories of data.
• ğ) (Annex: OG-28/4/2019-30758) The information of annual number of employees or annual financial balance sheet of the data controller.

(2) Board has the authority to take decisions in order to determine principles and procedures of implementation and the scope of exemptions determined in the framework of criteria listed in the first paragraph. Board shall announce such decisions to public via appropriate means of communication.