Common Misconceptions About VERBİS Registration
Especially these days, there is some confusion in practice regarding VERBİS registration. The primary cause is misinformation. In this document, we’ll list the common misconceptions about VERBİS, starting with recent confusion about registration deadlines.
1. A single deadline has been set for all data controllers, and everyone must complete their registration by that date.
Under Law No. 6698 on the Protection of Personal Data, a compliance period was introduced after the law came into effect, during which all KVKK obligations, including VERBİS registration, were expected to be fulfilled. The Personal Data Protection Authority (KVKK) extended the VERBİS deadline multiple times. The final deadline for all obligated data controllers was announced as 31 December 2021. Those required to register by this date included:
– Data controllers with 50+ employees annually or with an annual financial balance sheet total exceeding 25 million TRY (later updated to 100 million TRY).
– Entities whose primary activity involves processing sensitive personal data (e.g., doctors, dentists, pharmacists, psychologists, dietitians, etc.).
– Foreign-based data controllers.
– Public institutions and organizations.
What about companies that did not yet meet the obligation by the mentioned date?
Financial Threshold Condition
· For commercial companies, if the annual balance sheet exceeds 100 million TRY, registration must be completed within 1 month following the date of corporate tax return submission. Companies under the threshold are exempt from registration but must still comply with KVKK regulations.
· Entities whose main activity is the processing of sensitive personal data must register within 1 month of establishment.
· Foreign data controllers must register within 1 month of starting to collect personal data from Turkey.
Employee Number Condition
At the beginning of each year, data controllers must calculate the number of employees. If the number of employees exceeds 50 for any non-consecutive 6 months within the year, VERBİS registration must be completed by the end of January in this year. You can use the calculator at the link to make the calculation.
Notifications by the Authority
The Personal Data Protection Authority may conduct audits and, prior to issuing fines, send warning letters and allow additional time. In such cases, data controllers must register within the time indicated in the notice.
2.Every data controller must register with VERBİS.
Not all data controllers are required to register. Those meeting exemption criteria set by the Board are excluded — e.g., controllers with fewer than 50 employees and an annual financial balance sheet below 100 million TRY, whose primary activity is not processing sensitive personal data. Also, some professions are exempt due to their nature (e.g., notaries, lawyers, independent accountants, customs brokers).
3.Creating a preliminary application in the system fulfills the registration obligation.
No. Submitting the preliminary application which is often referred to as pre-registration does not complete the process. The process must be completed through steps including username-password retrieval and declaration submission. Failure to complete all steps may result in administrative fines.
4. Once registration is complete, there’s nothing else to do.
If any of the information declared in VERBİS changes, it must be updated within 7 days.
5.VERBİS registration alone ensures KVKK compliance.
VERBİS registration is only one of the requirements under the KVKK. A broader compliance process is required, including technical and administrative safeguards, risk assessment, and documentation.
6. Only capital-based companies need to register.
Public institutions, foreign data controllers (via representatives in Turkey), sole proprietors, and freelancers may also have registration obligations.
7.There is no penalty for not registering.
Failure to register with VERBİS may result in administrative fines. Please refer to the article in the link for details on administrative fines.
8. We can declare any information in VERBİS; no one checks it.
VERBİS is a public registry and declarations can be audited. The VERBİS entry must be consistent with the entity’s personal data processing inventory and actual practices. Any audit will evaluate this consistency.
For questions about VERBİS registration, you can contact our consultants via our website.