October 2025 – With the Decision of the Turkish Personal Data Protection Authority ("DPA") numbered 2025/1572 ("Decision"), published in the Official Gazette dated 1 October 2025, a new exemption criterion has been introduced regarding the scope of data controllers obliged to register with Türkiye's Data Controllers' Registry ("VERBIS").
Previously, the DPA stipulated that data controllers whose main activity involves the processing of special categories of personal data were subject to VERBIS registration without exemption.
With the newly published Decision, data controllers (natural or legal persons) whose main activity involves the processing of special categories of personal data, but who employ fewer than 10 employees and have an annual financial balance sheet total of less than TRY 10 million (approx. EUR 200,000), are now exempt from the VERBIS registration obligation.
In addition, as a result of the Decision, data controllers whose main activity involves the processing of special categories of personal data that also meet the exemption criteria set out in the Decision—such as small-scale pharmacies, clinics, and dental practices—have been exempted from the VERBIS registration obligation.
Consequently, data controllers that are currently registered with VERBIS but now fall within these exemptions may terminate their registration, as their obligation no longer applies.
The VERBIS registration obligation continues to apply, in
particular, to foreign data controllers located abroad, as well as
to data controllers that employ more than 50 employees or have an
annual financial balance sheet total exceeding TRY 100 million
(approx. EUR 2 million).
|
Currently, the following data controllers are obliged to
register with VERBIS: |
|---|
|
|
|
|
|
|
|
|
You can read the Decision at the following link (in Turkish only).
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
