New Developments Regarding The Obligation To Register With The Data Controllers' Registry

With the decision of the Personal Data Protection Board dated 04.09.2025 and numbered 2025/1572, which entered into force by being published in the Official Gazette on 01.10.2025, the scope of data controllers exempt from the obligation to register with the Data Controllers' Registry (VERBİS) has been amended.

Previously, data controllers whose main activity involved processing special categories of personal data were subject to the VERBİS registration obligation. However, with this amendment, data controllers employing fewer than 10 employees and with an annual financial balance sheet total below 10 million Turkish Liras have been included in the scope of exemption.

Accordingly, data controllers whose main activity is the processing of special categories of personal data but who qualify as small- or medium-sized enterprises in particular pharmacists, psychologists, private medical practices, dental clinics, laboratories, or dieticians, as well as other data controllers engaged in liberal professions or similar activities shall be exempt from VERBİS registration provided that they fall below both thresholds regarding the number of employees and the annual financial balance sheet total. However, if either of these thresholds is exceeded, the registration obligation will remain in effect.

As of the date the exemption decision entered into force, data controllers falling below the relevant thresholds will no longer be subject to VERBİS registration. Those who are currently registered with VERBİS may, although not obliged to, request to be removed from the registry.

Data Controllers Subject to VERBİS Registration Obligation Under the New Criteria

Within the scope of the aforementioned decision, the following data controllers, provided that they process personal data by automatic means as part of a data recording system, shall be subject to the obligation to register with the Data Controllers' Registry (VERBİS), except for notaries, political parties, lawyers, certified public accountants, sworn-in certified public accountants, customs brokers, and associations, foundations, trade unions that do not have any affiliated economic enterprises and village legal entities:

• Data controllers in Turkey, whether natural or legal persons, that employ more than 50 employees annually or have an annual financial statement exceeding 100 million Turkish Liras,
• Data controllers in Turkey, whether natural or legal persons, whose main activity is the processing of special categories of personal data and who employ more than 10 employees annually or have an annual financial balance sheet total exceeding 10 million Turkish Liras, and
• All foreign data controllers that process the personal data of individuals residing in Turkey (in other words, all data controllers established abroad that process the data of individuals residing in Turkey).

All data controllers established in Turkey are advised to regularly monitor the Withholding and Premium Service Declarations submitted monthly, and the financial statements attached to annual income or corporate tax returns submitted to public authorities. Based on the information provided within these declarations;

• If in at least 7 out of the 12 months of a completed year, the reported number of employees exceeds the determined thresholds (10 for those whose main activity is the processing of special categories of personal data, and 50 for other data controllers), the registration obligation shall arise. The annual number of employees shall be calculated according to this criterion. It is not required for the relevant 7 months to be consecutive. Any natural or legal persons that report more than 50 employees in 7 or more months of the same year will be obliged to register.
• If, in the financial statement submitted/attached to the annual tax return for a completed year, the value in either the "assets" or "liabilities" section exceeds the determined thresholds (10 million Turkish Liras for those whose main activity is processing special categories of personal data, and 100 million Turkish Liras for other data controllers), the registration obligation shall arise.

For data controllers established abroad, there are no such thresholds. In all cases where foreign data controllers process the personal data of individuals residing in Turkey as data controllers, they are required to appoint a data controller representative in Turkey and register with VERBİS.

What Needs to Be Done for VERBİS Registration?

In summary, the following steps must be taken for VERBİS registration:

• A clear, up-to-date, and accurate data inventory must be prepared, including the purpose of data processing, categories of data, data recipients, the maximum period required for data processing, data to be transferred abroad, and security measures to be taken for data protection.
• Data controllers not established in Turkey must appoint a data controller representative in Turkey.
• Data controllers in Turkey, as well as data controller representatives, must designate a real person as a contact person in order to complete the VERBİS registration. This person must be a citizen of the Republic of Turkey and resident in Turkey. A real person may not serve as the contact person for more than one data controller established in Turkey. This limitation does not apply to data controllers established abroad.

Sanctions

The Personal Data Protection Board conducts ex officio examinations on the data controllers that fail to fulfill the obligation to register with and notify VERBİS.

In this context, the Board has conducted examinations in respect of many data controllers determined to have an obligation to register with and notify VERBIS, and based on the algorithm table prepared according to the totals of their annual financial balance sheet assets, administrative fines have been imposed and continues to be imposed. In this context, for the year 2025, administrative fines may be imposed ranging from 272,380 Turkish Liras to 13,620,402 Turkish Liras. These administrative fines shall be increased annually in line with the revaluation rate determined annually.

Special thanks to Ufuk Ege Uçar for his contributions.

First published by Gün + Partners in Oct 03, 2025.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.