Introduction: Global Companies Operating in Turkey Must Ensure Data Protection Compliance
Companies worldwide that have activities related to Turkey, engage in data transfers to/from Turkey, or maintain partnerships, branches, or subsidiaries within the country must comply with Turkey's Personal Data Protection Law (KVKK).
Under the KVKK, data controllers—whether based in Turkey or abroad—are required to register with the Data Controllers' Registry (VERBIS), an online system established by the Personal Data Protection Authority (KVKK Authority).
The deadline for this mandatory registration expired on December 31, 2021. However, compliance remains a pressing issue, as the KVKK Authority has begun imposing administrative fines not only on companies that have failed to register but also on those that registered late. Furthermore, penalties are being applied for each year of non-compliance, meaning companies that have not yet fulfilled this obligation continue to face financial and legal risks.
Even foreign companies that transfer personal data from Turkey abroad—such as employee or customer names, contact details, or more sensitive categories of personal data—may be fined for failing to meet their VERBIS registration requirements. This applies even to those with minimal presence in Turkey, such as liaison offices with no direct commercial activity. This underscores the strict enforcement of the KVKK compliance framework and the importance of taking immediate action.
Below, we provide an overview of the VERBIS registration obligation and the legal consequences of non-compliance.
Who Must Register with VERBIS?
Under Turkish Data Protection Law, the following entities are required to register with VERBIS:
📌 Data Controllers Based in Turkey:
- Those with more than 50 employees annually or
- An annual financial balance sheet exceeding 100 million TL
- Those processing special categories of personal data, regardless of employee count or financial threshold
- Public institutions and organizations acting as data controllers
📌 Data Controllers Based Abroad:
- ALL foreign data controllers processing personal data related to Turkey must register, irrespective of their number of employees or financial size.
📌 Companies That Transfer Personal Data from Turkey Abroad:
- If your company transfers personal data outside Turkey and qualifies as a data controller, you are required to register with VERBIS.
Strict Enforcement & Ongoing Penalties
- The deadline for VERBIS registration was December 31, 2021.
- Companies that failed to register on time are subject to penalties for each year of non-compliance.
- Late registration does not exempt companies from fines.
The KVKK Authority has now actively started imposing financial penalties on:
- Companies that failed to register with VERBIS
- Companies that registered late
- Foreign companies, even those with minor operations in Turkey
⚠️ Even a foreign company with only one employee in Turkey and no direct commercial activity was fined for a mere two-month registration delay.
Key Risks of Non-Compliance
- Delayed registration does not eliminate liability.
- Fines are imposed for each year of non-compliance.
- Companies transferring personal data from Turkey abroad are also subject to VERBIS registration.
While completing registration late may serve as a mitigating factor, the KVKK Authority remains strict on enforcement. Companies must proactively assess their compliance status to avoid financial and reputational damage.
Action Plan: How to Ensure Compliance
- Assess whether your company qualifies as a data controller under Turkish law.
- If required, complete your VERBIS registration immediately.
- Review your data processing activities related to Turkey and ensure compliance with KVKK.
- Consult legal professionals for guidance on fulfilling your data protection obligations.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
