Data Controllers’ Register (VERBİS)
Pursuant to Article 16 of the Law, there is an obligation to register with the Data Controllers’ Register (“VERBİS”) for data controllers established in Türkiye that exceed the specified thresholds, as well as for data controllers established abroad that process personal data in Türkiye as data controllers, without being subject to any threshold criteria.
The procedures and principles governing the VERBİS system, which is maintained as a public register, are set out in the “Regulation on the Data Controllers’ Register” (“VERBİS Regulation”) dated 30 December 2017.
By virtue of the Board’s decisions dated 2018, various professional groups, associations, foundations and political parties have been exempted from the VERBIS registration obligation; furthermore, minimum criteria based on the number of employees and balance sheet figures have been introduced for data controllers established in Türkiye to determine those subject to the registration obligation and those exempt from it.
With its Decision No. 2025/1572 dated 04 September 2025, the Board decided that natural or legal person data controllers whose main activity involves the processing of special category personal data, but who have fewer than 10 employees and an annual financial statement of less than 10 million TRY, shall also be exempt from the obligation to register with the Register and make notifications.
Currently, natural or legal person data controllers with fewer than 50 employees and a total annual financial statement of less than 100 million TRY, whose principal activity is not the processing of special category personal data, as well as those whose principal activity is the processing of special category personal data but who have fewer than 10 and whose annual financial statement is less than 10 million TRY, are exempt from the VERBİS registration obligation.
Following requests for opinions regarding the implementation of the Board’s Decision No. 2025/1572 dated 04 September 2025, the Board has published a public announcement concerning the implementation principles of the said decision. Accordingly, in determining which data controllers are exempt from the VERBİS registration obligation, for data controllers keeping accounts on a balance sheet basis, both the “annual number of employees” and the “total annual financial statement” criteria are taken into account cumulatively; however, for data controllers who do not keep accounts on a balance sheet basis, it has been decided that only the “annual number of employees” criterion will be applied, as an annual financial statement is not available.
It should be noted that these criteria do not apply when assessing the VERBİS registration obligation for data controllers established abroad.
The Authority has updated the VERBİS (Data Controllers’ Register Information System) Guide and the Data Controllers’ Register Information System for 2025 (VERBİS) Guide, which it had published in 2025 to assist data controllers in fulfilling their registration and notification obligations. In its report titled “The Personal Data Protection Authority in Its 8th Year”, the Authority has shared statistics on the activities and developments since its establishment, noting that, as of 30 April 2025, 197,971 data controllers had been registered under the VERBİS registration scheme.
The range of administrative fines to be imposed in the event of a breach of the VERBİS registration obligation for the year 2026 will be between 341,809 TRY and 17,092,242 TRY. The Board uses certain algorithms to determine the amount of the fine; accordingly, within the specified fine range, the higher the total assets on the financial statement, the closer the fine amount will be to the upper limit.
The Board actively monitors data controllers established in Türkiye in the light of the declarations they submit to the Social Security Institution and tax offices and may impose administrative fines without prior warning on data controllers who exceed the thresholds should they fail to fulfil their registration obligations. The Board also investigates data controllers established abroad that process the data of individuals resident in Türkiye and may impose fines on such data controllers as well. Consequently, to mitigate the risk of fines, it is recommended that compliance with the registration obligation be regularly monitored and tracked.
It should be noted at this point that the Law also applies to data controllers (whether established in Türkiye or supplying goods and services to Türkiye) who target data subjects in Türkiye, regardless of their nationality, even if they do not reside in Türkiye. Therefore, data controllers established abroad are subject to the obligation to register with VERBİS if they carry out personal data processing activities in Türkiye, either directly or through their branches, or if they process personal data transferred to them for their own purposes.
Legal entities established abroad will be required to register with VERBİS if they process personal data for their own purposes as data controllers. The key distinction to note here is that the legal entity’s activities must target data subjects in Türkiye and that it must be processing the relevant personal data for its own purposes as a data controller. However, the mere fact that personal data is stored in the data recording system of a legal entity established abroad will not give rise to a VERBIS obligation.
Finally, it is worth noting that data controllers established abroad who are required to register with VERBIS must, in accordance with the VERBIS Regulation, appoint a data controller representative to act as a point of contact in their dealings with the Board, the Authority and data subjects. The data controller’s representative may be a legal entity established in Türkiye or a natural person who is a citizen of Türkiye. The appointment of a representative must be made by means of a decision by the data controller that is notarised and apostilled (or otherwise certified). Where a legal entity is appointed as the representative, a natural person must also be appointed by the foreign data controller to act as the contact person.
Data controllers established within Turkiye who have not yet registered with VERBIS must identify their annual staff numbers and annual financial statements each year to determine whether they are subject to VERBIS registration obligations. In particular, data controllers who have not fulfilled their VERBIS obligations, alongside the standard contracts signed and notified the Authority regarding cross-border data transfers, will come under scrutiny in light of recent developments in cross-border data transfers. We therefore recommend that organisations acting as data controllers and based abroad check their VERBIS obligations and ensure that the assessment and fulfilment of their VERBIS registration obligations are completed no later than the date on which the relevant standard contracts are signed and submitted to the Authority.