(1) Registration Application to the Registry includes the following information:

• a) The information included in the application form determined by the Board relating to the identity and address of the data controller, representative of the data controller, if any and contact person,
• b) The purposes for which the personal data will be processed,
• c) The explanations about group(s) of persons subject to the data as well as about the data categories belonging to these people,
• ç) The recipients or groups of recipients to whom personal data may be transferred,
• d) The personal data which are envisaged to be transferred abroad,
• e) Measures taken as referred to in Article 12 of the Law and in accordance with the criteria determined by the Board,
• f) Maximum storage period of personal data laid down by the legislation or for the purposes for which personal data are processed,

2) Information to be entered into the Registry by data controllers pursuant to subparagraphs (b), (c), (ç) and (d) of the first paragraph; shall be transmitted through VERBIS to the Registry based on Personal Data Processing Inventory by using headings given in VERBIS.

(3) Information to be entered into the Registry by data controllers pursuant to subparagraph (e) of the first paragraph shall be transmitted through VERBIS to the Registry in the manner that cover the issues specified in the Article 12 of the Law by using headings given in VERBIS.

(4) Information relating to the maximum storage period laid down by the legislation or for the purposes for which personal data are processed relating to the personal data to be entered into the Registry by data controllers pursuant to the subparagraph (f) of the first paragraph, shall be entered into the Registry by matching them with data categories. Maximum storage period necessary for the purposes of processing of data categories entered into the Registry by the data controller may differ from the period envisaged in the legislation. In such cases, if maximum storage period is envisaged in the legislation, this period shall be entered into the Registry, if not envisaged, the longest storage period of this category shall be entered into the Registry. While determining the maximum storage period required for purposes for which personal data are processed, following issues shall be taken into account:

• a) The period generally accepted in the sector in which the data controller operates within the scope of purposes for processing relevant data category,
• b) The period that requires processing of personal data in the relevant data category and to continue legal relationship with the data subject,
• c) The period to be valid for the legitimate interest to be obtained by the data controller in accordance with lawfulness and fairness, depending on the purpose of processing relevant data category,
• ç) The period in which the risks, costs and responsibilities arising from the storage of the relevant data category depending on the purpose of processing shall continue legally,
• d) Whether maximum storage period to be determined is appropriate to keep the relevant data category accurate and up-to-date where necessary,
• e) Time period in which the data controller is obliged to retain personal data given in the relevant data category pursuant to its legal obligation,
• f) Period of limitation determined by the data controller for assertion of a right relating to personal data in the relevant data category.

(5) Data controllers shall issue a personal data storage and disposal policy for defining maximum storage period of personal data for the purposes of processing, complying with this period indicated in personal data processing inventory and tracking whether these periods are exceeded or not and shall ensure the implementation of such policy.

(6) In cases where headings and contents given in VERBIS do not cover operations of the data controller and the information to be entered into the Registry, the data controller shall complete its registration by entering such information into “Others” section in VERBIS which is provided for such cases.