VERBİS Registration Under KVKK: Who Must Register and How

If your company processes personal data connected to Türkiye, you may be required to enrol in VERBİS — the Data Controllers' Registry (Veri Sorumluları Sicili) kept by the Turkish data protection authority. This obligation comes from Article 16 of the Personal Data Protection Law No. 6698 (Kişisel Verilerin Korunması Kanunu, "KVKKKVKKPersonal Data Protection Law No. 6698Türkiye's data protection statute — the rules on collecting, storing and transferring personal data, and the authority that enforces them.Glossary →"). In short: most organisations acting as a "data controller" must register before they begin processing, unless they fall within a published exemption — and failing to register can lead to an administrative fine. Below we explain who must register, who is exempt, what information the registry asks for, how registration links to appointing a contact person or representative, and what happens if you skip it.

What VERBİS is and where the duty comes from

VERBİS stands for Veri Sorumluları Sicil Bilgi Sistemi — the information system that runs the Data Controllers' Registry (Veri Sorumluları Sicili). It is an online registry maintained by the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, "KVKK Authority"), under the supervision of the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, the "Board").

The legal basis is Article 16 of the Personal Data Protection Law No. 6698. That article requires people and organisations who qualify as a data controller (veri sorumlusu — the party that decides why and how personal data is processed) to enrol in the registry before they begin processing personal data, unless an exemption applies. The Board is empowered to set the criteria that decide who must register and to publish exemptions.

Registration is not the same thing as "complying with KVKK". Even a controller that is exempt from VERBİS still has to obey the rest of the Law — lawful processing, information notices, data security, and responding to data-subject requests. VERBİS is one specific transparency obligation, not the whole of your duties.

Who must register in VERBİS?

The short answer: data controllers who meet the criteria set by the Board must register. The Board decides these criteria by looking at factors such as the nature and volume of the personal data processed, whether the processing is part of the controller's main activity, and — importantly for businesses — measures of the controller's size such as the number of employees and annual financial/balance-sheet figures.

As a practical matter, this means three common situations arise:

• You clearly must register — for example, larger companies above the size thresholds, and certain controllers (such as those whose main business involves processing special categories of data) regardless of size.
• You are likely exempt — many small organisations fall below the thresholds the Board has set, and several activity-based exemptions exist (see the next section).
• It is genuinely unclear — you sit near a threshold, or your processing changed during the year. This is where a controller most often gets it wrong.

For a foreign company, the trigger is usually that it processes personal data in Türkiye as a data controller — for instance, running a Turkish branch, employing staff in Türkiye, operating a Türkiye-facing platform, or otherwise handling the personal data of people in Türkiye in a way that brings it within the Law. Where that is the case, the controller is generally expected to enrol in VERBİS in the same way as a domestic controller, subject to the same criteria and exemptions.

Exemptions: who does not have to register

Article 16 lets the Board exempt categories of data controllers from registration. The exemptions are set out in Board decisions and secondary regulation, and they fall into two broad types.

Size-based exemption

Controllers below the Board's size criteria are commonly exempt. This is where the employee-number and annual balance-sheet/turnover thresholds matter: if you sit under them — and you are not caught by an activity-based rule — you may not need to register.

Activity-based exemptions

The Board has also exempted certain controllers because of what they are or what they do, rather than their size. Categories that have appeared in the exemption list over time include, for example, certain professionals and associations and similar bodies processing data only for their own internal, defined purposes. The precise list, and its conditions, is set by the Board.

What information the registry requires

VERBİS is built around a personal data processing inventory (kişisel veri işleme envanteri). To register, you declare — and keep updated — a structured description of your processing. The categories of information the registry asks for typically include:

• Identity and contact details of the data controller, and of the contact person or representative.
• Categories of data subjects (for example employees, customers, suppliers, website users).
• Categories of personal data processed, with special categories (such as health, biometric, or criminal-record data) flagged separately because they attract stricter rules.
• Purposes for which the data is processed.
• Recipients or categories of recipients to whom data may be disclosed.
• Transfers abroad — whether personal data is or may be transferred to recipients outside Türkiye.
• Maximum retention periods for each category of data.
• Technical and organisational security measures taken to protect the data.

The inventory you maintain internally and the VERBİS declaration must line up. A registration that does not match how your business actually processes data is itself a problem.

The contact person and the representative for foreign controllers

Registration is closely tied to nominating someone to deal with the Authority and with data subjects.

Contact person (irtibat kişisi)

A data controller established in Türkiye that registers in VERBİS designates a contact person (irtibat kişisi). The contact person is the point of communication with the Authority. Importantly, being the contact person does not transfer legal responsibility — the data controller remains responsible for compliance.

Representative for controllers based abroad

Where the data controller is not resident in Türkiye, the established expectation is that it appoints a representative in Türkiye (a Türkiye-resident legal entity or a Turkish citizen) to be reachable by the Authority and by data subjects, and to complete the VERBİS registration on the controller's behalf. The representative's authority should be properly documented.

The exact form, scope of authority, and documentation required for the representative are matters of detail in the secondary regulation, so the appointment should be set up to satisfy the current rules rather than a generic template.

What happens if you fail to register

If you are required to register and you do not — or you process personal data without completing a registration you were obliged to make — you expose the company to an administrative fine. The penalty regime for breaches of the registration obligation sits in Article 18 of KVKK No. 6698, which lists the misdemeanours (kabahatler) and the administrative fines that the Board can impose.

Beyond the fine itself, an unregistered or inaccurate VERBİS position is often the first thing that surfaces in a complaint or an audit, and it can colour how the Authority views the rest of your compliance. Registering correctly — and keeping the entry current — is the cheaper path.

A practical sequence for foreign companies

If you are a foreign company trying to work out your position, a calm, ordered approach usually works best:

• Confirm your role. Are you a data controller (you decide the why and how) or a processor acting for someone else? The registration duty attaches to the controller.
• Map your processing in Türkiye. What data, whose data, for what purposes, who receives it, and does any of it go abroad?
• Check the criteria and exemptions for the current year against the Board's in-force rules — size thresholds and any activity-based exemption.
• Sort out your contact person or Türkiye representative and document their authority.
• Prepare your processing inventory and reconcile your cross-border-transfer position with the post-2024 Article 9 regime.
• Register in VERBİS within the applicable deadline, then keep the entry updated whenever your processing changes.

None of these steps should be decided on a remembered figure or a generic template. Each turns on rules the Board has set and revises, and on the specific facts of how your business handles data connected to Türkiye.

Frequently asked questions