VERBIS registration is how a data controller in Türkiye records its personal data processing with the Personal Data Protection Authority's Data Controllers' Registry Information System. Organisations with 50 or more employees a year, or an annual balance sheet above the Board's threshold, must register. What you declare has to match your data inventory and be updated whenever it changes.
Key takeaways
- Data controllers with 50 or more employees, or an annual balance sheet above the Board's threshold, must register with VERBIS.
- Organisations whose main activity is processing special category data, and controllers established outside Türkiye, must register even below the thresholds.
- According to the KVKK 2025 Annual Activity Report, 594 of the 876 data controllers fined in 2025 were penalised over registry obligations.
- Every registry entry comes from your personal data inventory; retention periods must match your retention and disposal policy.
- When registered details change, the Regulation on the Data Controllers' Registry requires an update within 7 days.
What is VERBIS, and why is it so often neglected?
Article 16 of Türkiye's Personal Data Protection Law (KVKK, Law No. 6698) requires a public Data Controllers' Registry kept under the supervision of the Personal Data Protection Board. VERBIS (Veri Sorumluları Sicil Bilgi Sistemi, the Data Controllers' Registry Information System) is the online version of that registry. Unless an exemption applies, individuals and organisations that process personal data must register before they start processing.
VERBIS has no direct equivalent under the EU General Data Protection Regulation (GDPR): the EU dropped general registration in favour of internal records of processing, while Türkiye kept a public register.
VERBIS problems begin when registration is treated as a one-off job. Many companies filed in a hurry around the first deadlines, often from a template. Since then they have added new software, moved services to overseas clouds and installed CCTV or time and attendance terminals, yet the registry still shows the picture from day one. Another common case is the growing company that never notices it has crossed the threshold: when headcount passes 50, the obligation arises automatically and nobody sends a reminder.
What happens if you do not register with VERBIS?
The Board's enforcement figures show that registration is the duty it penalises most often:
According to the KVKK 2025 Annual Activity Report, 594 of the 876 data controllers fined in 2025, more than two thirds, were penalised under the obligation to register with and notify the Data Controllers' Registry.
A missing VERBIS entry is easy to spot, because the registry is public and anyone can check in seconds whether a company is listed. The same annual report records 12,512 complaints and reports received in 2025. A complaint from an employee or customer can widen into a review of your registration; how to answer such requests is covered in our guide to KVKK data subject request handling.
Being registered with VERBIS is not enough on its own either. If a company declares a maximum retention period or "no overseas transfers", and it turns out data is kept indefinitely or sent to a foreign service, the gap between declaration and practice becomes the issue. After a breach, the security measures you declared are likely to come under scrutiny. We explain which services count as transfers abroad, and how to manage them, in KVKK cross-border data transfer. If you will hand registration to a consultant, see choosing a data protection consultant for picking the right firm.
Who must register with VERBIS in Turkey, and who is exempt?
Through a series of decisions, the Board has exempted certain data controllers from VERBIS registration. As of 2026, the general framework looks like this:
| Situation | VERBIS registration |
|---|---|
| 50 or more employees per year | Required |
| Annual balance sheet above the threshold set by the Board | Required, regardless of headcount |
| Main activity is processing special category data (e.g. a clinic handling health data) | Required, even below the thresholds |
| Data controller established outside Türkiye | Required, through an appointed representative |
| Fewer than 50 employees, balance sheet below threshold, main activity not special category data | Exempt |
| Professions and bodies listed in Board decisions (e.g. notaries, lawyers, accountants, mediators, associations and foundations) | Exempt within the scope of the decision |
The balance-sheet threshold is updated by Board decision from time to time, so base your assessment on the latest decision published on the Authority's website. Data controllers established outside Türkiye appoint a data controller representative, which must be a legal entity established in Türkiye or a Turkish citizen; the representative handles communication with the Authority and with data subjects.
A VERBIS exemption only removes the registration duty; the obligations to inform, keep data secure, retain and dispose of it properly and report breaches still apply. Our articles on each of these duties are collected in the Cyber Security & Compliance guide. The obligations of an online store beyond VERBIS are collected in our guide to e-commerce legal requirements in Turkey.
How do you register on VERBIS? Step by step
- Prepare the inventory first. VERBIS looks like form-filling, but every answer comes from your personal data inventory. Without one, registration is guesswork. Our KVKK compliance roadmap explains how to build it, and the columns and sample rows are in our personal data inventory guide.
- Document the obligation and timing. Record the source and date of your headcount and balance-sheet figures. When a threshold is crossed, confirm the registration deadline from the Authority's current announcements.
- Appoint a contact person. Legal-entity data controllers appoint a contact person who handles communication with the Authority. This is usually the person who files and maintains the entry, so replace them promptly if they leave.
- Complete the controller registration and contact person login. An application is made on behalf of the data controller, then the contact person logs in with their own identity to prepare the notification. Check the Authority's VERBIS guidance for the current login and application channels, as they change over time.
- Enter your processing activities. Under Article 16, the registry covers the purposes of processing, groups of data subjects and data categories, recipient groups, data expected to be transferred abroad, security measures taken and maximum retention periods.
- Align retention periods with your policy. The maximum periods in VERBIS must match those in your data retention and disposal policy.
- Confirm the notification and keep evidence. Add the system output and its date to your compliance file.
- Update after every change. Under the Registry Regulation, changes to registered information should be reported within 7 days. New software, a new overseas service or a new group of data subjects are all triggers.
The Authority's own figures show how widespread this process is. According to the KVKK 2025 Annual Activity Report, VERBIS had received 249,474 applications by 31 December 2025, and 149,118 data controllers had filed their notifications.
Example: what does a 60-person manufacturer declare?
A concrete case makes the content of a VERBIS entry clearer. Take a manufacturer in Adana with 60 employees. Headcount is above 50, so registration is mandatory.
The inventory work identifies these groups of data subjects: employees, job applicants, visitors, supplier contacts and customer contacts. For employees, the categories include identity, contact, personnel file, finance (payroll), professional experience and physical site security (card access logs and CCTV footage); if fingerprint readers are used, biometric data is added. For retention periods and notice rules for camera footage, see CCTV recording and KVKK.
Recipient groups include authorised public bodies such as the Social Security Institution (SGK) and the tax office, the occupational health and safety provider and the payroll software vendor; the contract you need with such vendors is covered in our guide to data processing agreements in Turkey. If email or backups run on a server abroad, that is recorded as a cross-border transfer; how data location shapes the choice of provider is covered in our article on cloud migration cost.
Each category's maximum retention period is copied from the retention and disposal policy. None of this detail can come from a template; it can only come from the inventory.
What are the most common VERBIS mistakes?
- Ticking everything. Selecting every data category and purpose "just in case" means declaring processing you do not actually carry out.
- Forgetting CCTV and attendance systems. Camera footage and card or biometric access data are often missed. If you run cameras across several sites, list where recordings are stored and for how long, as described in central management of IP cameras. If you use fingerprint readers, you are processing special category data; see biometric attendance and data protection.
- Leaving email without a retention period. Mail archives hold data on many groups of people; the table in email archiving and data protection helps set the period.
- Declaring measures that do not exist. If you state that access is logged or a permission matrix is in place, the systems must back that up. Our guides to file sharing permissions and the SME cyber security checklist help close the gap.
- Treating breach response as separate. Declared measures are among the first documents reviewed after an incident, so keep our 72-hour breach notification guide in the same file.
How we handle VERBIS and the data inventory at Digital Bridge
In its data protection compliance consultancy, Digital Bridge treats VERBIS as an output of the inventory, not a separate form. We interview process owners, then verify what they tell us in the systems themselves: which table holds which personal data, which software sends it where, and where the backups are.
- We extract data categories and recipient groups from HR, payroll and personnel management systems, where staff data is most concentrated.
- We build retention periods per document type into document management systems and align them with the VERBIS entries.
- We clarify data ownership and duplicate personal records across applications through data governance and quality work.
- With our cyber security consultancy team we check that the declared technical measures genuinely exist.
Finding which documents on scattered file servers hold personal data is often the hardest part of the inventory. Digital Bridge's own SmartFiles business file management product scans readable documents for Turkish ID numbers, IBANs, card numbers, phone numbers and email addresses, and flags terms suggesting health, criminal record or biometric data as "possible special category data". In SmartFiles, folders can be given a retention period of 1 to 30 years and expired documents are listed for the person responsible, so the maximum periods you declare in VERBIS can be tracked at file level too. SmartFiles is part of the Smart360 product family; plans are listed on SmartFiles.com.tr, and you can buy SmartFiles online.
On the consultancy side we do not sell off-the-shelf packages; after a needs analysis we prepare a written proposal covering scope, phases and cost.
Next step for your VERBIS registration
Start with three questions. What was your average headcount last year? Are you on the registry, and if so, when was the entry last updated? Which new software or services have you adopted since then?
Send us your answers through our contact page and we will compare your registry entry with your inventory and list the gaps together.