VERBİS (Data Controllers’ Registry)

VERBİS is the electronic system of the Data Controllers’ Registry established under Article 16 of the KVKK. Data controllers record their processing purposes, data categories, data subject groups, recipient groups, data transferred abroad, retention periods and security measures in this system. The registry is public.

Who Must Register?

As a rule, all data controllers must register, but the Board has introduced broad exemptions:

• General exemption: Data controllers with fewer than 50 employees annually and an annual balance sheet total below TRY 100 million, whose main activity is not processing special categories of personal data, are exempt.
• Exemption introduced in 2025: By Board decision 2025/1572 dated 04.09.2025, data controllers with fewer than 10 employees and an annual balance sheet total below TRY 10 million are also exempt, even if their main activity is processing special categories. The decision entered into force on 1 October 2025.
• Certain professions and organisations: Some data controllers, such as notaries, lawyers, financial advisers, mediators, associations, foundations and trade unions, have also been exempted under certain conditions by Board decisions.

Data controllers established abroad must register through a data controller representative appointed in Turkey, regardless of these thresholds.

Registration and Updates

The information entered in VERBİS should be based on a personal data inventory; registrations made without an inventory often do not reflect reality. A contact person is notified during registration. When the registered information changes, it must be updated within seven days of the change.

The exemption concerns only registration: a company not required to register with VERBİS is still subject to the duty to inform, data security and all other KVKK obligations. Breaching the registration obligation, meanwhile, is subject to one of the highest administrative fines under the KVKK.