Data Controllers’ Registry (VERBIS)
Pursuant to Article 16 of the Law, data controllers who meet certain criteria are obliged to register with the Data Controllers’ Registry ("VERBIS"). The procedures and principles regarding the VERBIS system, which is open to the public, are determined by the "Regulation on the Data Controllers Registry" dated December 30, 2017 ("VERBIS Regulation").
With the Board's decisions dated 2018, various professional groups, associations, foundations and political parties were exempted from VERBIS registration obligation and minimum criteria based on the number of employees and balance sheet were introduced for data controllers residing in Turkiye in determining the registration obligation and those who will be exempted from the registration obligation.
Regarding the aforementioned minimum criteria, with the decision published in 2023, the Board updated the annual financial balance sheet total amount in the criterion of having an annual financial balance sheet total of more than 25 million Turkish Liras, which is one of the criteria used in determining the data controllers exempted from the VERBIS registration obligation, and increased the annual financial balance sheet total amount to 100 million Turkish Liras. Among the natural or legal person data controllers whose annual number of employees is less than 50 and whose annual financial balance sheet total is less than 100 million Turkish Liras, data controllers whose main activity is not processing special categories of personal data are exempted from VERBIS registration. It should also be noted that for data controllers resident in Turkiye, crossing only one of the limits regarding the number of employees or the annual financial statement total is sufficient for the VERBIS registration obligation to be triggered, and for data controllers residing abroad, these criteria are not applied in the assessment of the obligation.
Accordingly, the range of administrative fines to be imposed in case of violation of the VERBIS registration obligation for 2025 will be between 272,380 Turkish Liras and 13,620,402 Turkish Liras. The Board uses certain algorithms to determine the amount of the fine, and accordingly, the higher the total assets in the financial balance sheet within the specified fine range is, closer the fine amount gets to the upper limit.
The Board actively monitors data controllers residing in Turkiye in light of their notifications to the Social Security Institution and tax authorities and may impose administrative fines on data controllers who exceed the thresholds without warning if they fail to fulfil their registration obligations. The Board also investigates data controllers residing abroad who process data of Turkish residents and may impose fines on these data controllers as well. Therefore, in order to minimize the risks of fines, it is recommended to regularly check and monitor the registration obligation.
At this point, it should be noted that the Law also applies to data controllers (resident in Turkiye or providing goods and services to Turkiye) who target data subjects in Turkiye, regardless of their nationality even if they do not reside in Turkiye. Thus, the obligation to register with VERBIS arises in the event that data controllers residing abroad engage in personal data processing activities in Turkiye, either directly or through their branches or process personal data transferred to them for their own purposes.
Therefore, non-resident legal entities that are parents of a resident data controller will be obliged to register with VERBIS if they process the personal data transferred to them as a data controller for their own purposes. The distinction to be noted at this point is that the activities of the legal entity must actually target data subjects in Turkiye and process the relevant personal data as a data controller for its own purposes. The mere fact that personal data is kept in the data registry system of a legal entity residing abroad will not give rise to a VERBIS obligation.
Data controllers residing in Turkiye who have not yet registered with VERBIS must assess their annual employee numbers and annual financial statements each year to determine whether they have a VERBIS registration obligation. Particularly in light of recent developments in international data transfers, data controllers who have signed and reported standard contracts related to cross-border transfers to the Board but have not fulfilled their VERBIS obligations will attract attention. Therefore, institutions acting as data controllers and located abroad should check their VERBIS obligations and ensure that their VERBIS registration is completed no later than the submission of the relevant standard contracts to the Board.
Finally, it is worth noting that, pursuant to the VERBIS Regulation, foreign-based data controllers who are obliged to register with VERBIS must appoint a data controller representative to act as a point of contact in their relations with the Board, the Authority and data subjects. The data controller representative may be a legal entity resident in Turkiye or a natural person who is a citizen of the Republic of Turkiye. The appointment of a representative must be made by a notarized and apostilled (or otherwise certified) decision of the data controller. If a legal entity is appointed as a representative, a natural person must also be appointed by the foreign data controller to act as a contact person.
First published by Gün + Partners in Mar 04, 2025.