(1) In respect of the following personal data processing activities, data controllers are not obliged to register and notify these activities to the Registry:

• a) Data processing is necessary for the prevention of committing a crime or for crime investigation.
• b) Processing the data which are made public by the data subject himself/herself.
• c) Data processing is necessary for performance of supervision or regulatory duties and disciplinary investigation and prosecution to be carried out by the assigned and competent public institutions and organizations and by the public professional organizations, in accordance with the power conferred on them by the law,
• ç) Data processing is necessary for protection economic and financial interests of State related to budgetary, tax and financial matters.

(1) The Board may provide derogation from registration obligation by considering following criteria:

• a) The nature of personal data.
• b) The quantity of personal data.
• c) The purpose of processing of personal data.
• ç) The field of activity where personal data are processed.
• d) Transferring personal data to third parties.
• e) The fact that the processing of data is laid down in the laws.
• f) Storage period of personal data.
• g) Group of persons subject to the data or categories of data.
• ğ) (Annex: OG-28/4/2019-30758) The information of annual number of employees or annual financial balance sheet of the data controller.

(2) Board has the authority to take decisions in order to determine principles and procedures of implementation and the scope of exemptions determined in the framework of criteria listed in the first paragraph. Board shall announce such decisions to public via appropriate means of communication.