Has Your Obligation to Register with the Data Controllers’ Registry (VERBİS) Arisen Based on the Financial Balance Sheet?

Pursuant to Article 16 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”), natural and legal persons who process personal data are required to register with the Data Controllers’ Registry (“VERBİS”). There are specific criteria established by the Turkish Personal Data Protection Board (“Turkish DPA”) for VERBİS registration.

The Decision of the Turkish DPA dated 0607.2023 and numbered 2023/1154 has been published in the Official Gazette dated 25.07.2023. With this decision, the Turkish DPA has amended the “annual total financial balance sheet “criterion, which is considered as a basis for exemption from the obligation to register to the VERBIS.

In the Turkish DPA’s Decision dated 19.07.2018 and numbered 2018/87, the threshold for the “annual total financial balance sheet” in the phrase “natural or legal person data controllers whose annual number of employees is less than 50 and whose annual total financial balance sheet of less than 25 million TRY, whose primary activity is not processing special categories of personal data” has been increased to 100 million TRY.

As of 31.03.2025, based on the corporate tax and income tax declarations submitted by all taxpayers for the year 2024, data controllers with an annual total financial balance sheet exceeding 100 million TRY are required to register with VERBİS as of the date of submission of the declaration.

According to the Turkish DPA’s decision No. 2018/88, data controllers must complete their VERBİS registration within 30 days after their obligation to register arises.

The amount of administrative fine to be imposed by the Turkish DPA in the event of not fulfilling the obligation to register with VERBIS has been determined in the range of 272,380TRY – 13,620,402TRY for the year 2025.

Please contact us for detailed information.