Has Your Obligation to Register with VERBIS Arisen as of 2024?

Pursuant to Article 16 of the Turkish Personal Data Protection Law No. 6698 (“the Law”), “Natural and legal persons who process personal data are required to register with the Data Controllers’ Registry (“VERBIS”) prior to commencing data processing.” Accordingly, real and legal person data controllers who either employ more than 50 persons annually or, as per the amended criteria announced by the Turkish Personal Data Protection Authority on 25.07.2023, have an annual financial balance sheet total exceeding TRY 100 million are required to register with VERBIS.

In addition, data controllers located abroad; public institutions and organizations, as well as professional organizations having the status of public institutions; and real or legal persons who process sensitive personal data as part of their core activities are also obligated to register with VERBIS regardless of whether they meet the employee or financial threshold criteria.

Although Article 16 of the Law stipulates that data controllers must complete their VERBIS registration before initiating any data processing activities, this obligation may arise at a later time due to evolving circumstances. For example, if a legal entity employing fewer than 50 people in 2022 exceeds the annual threshold of 50 employees in 2023, the obligation to register with VERBIS will arise as of 2024. In such cases, the data controller must complete the registration within 30 days from the date the obligation arises. Failure to comply may result in administrative fines as stipulated by the Law.

The calculation to determine whether the annual threshold of 50 employees has been met must be conducted by the data controller at the end of each year. If the criteria are fulfilled, the VERBIS registration process should be initiated without delay. Considering that the VERBIS registration consists of a two-step process and requires prior preparation, proper use of the 30-day period is of critical importance.

It is important to note that fulfilling the VERBIS registration requirement alone does not ensure full compliance with the Law. Even if a data controller does not meet the employee or financial criteria, they are still obligated to comply with the other provisions imposed by the Law.

CLICK HERE TO DETERMINE WHETHER YOUR VERBIS REGISTRATION OBLIGATION HAS ARISEN