13 January 2026
Clarification on the Application Principles of VERBİS Registration Exemptions
With the decision of the Turkish Personal Data Protection Board dated December 25, 2025 and numbered 2025/2393, the application principles regarding exemptions from the VERBIS (Data Controllers' Registry Information System) registration obligation have been clarified. The decision aims to eliminate uncertainties arising from the implementation of the Board's decision dated September 4, 2025 and numbered 2025/1572, which amended the scope of VERBIS registration exemptions.
Pursuant to Article 16 of the Turkish Personal Data Protection Law No. 6698, data controllers processing personal data are required to register with VERBIS. However, the Board may grant exemptions from this obligation based on objective criteria such as the nature and volume of personal data processed, and the characteristics of the data processing activities.
Under the Board's decision dated 4 September 2025, the scope of exemptions was expanded. Accordingly:
- Data controllers whose main activity is not the processing of special categories of personal data continue to benefit from the existing exemption and
- An additional exemption was introduced for micro-scale data controllers whose main activity involves the processing of special categories of personal data.
In this context, data controllers whose main activity involves the processing of special categories of personal data are exempt from VERBIS registration provided that they meet both of the following criteria:
- Fewer than 10 employees, and
- An annual financial balance sheet total of less than TRY 10 million.
However, in practice, questions arose as to how the "annual financial balance sheet total" criterion should be interpreted for data controllers that do not keep accounting records on a balance sheet basis. In response to these concerns, the Board issued its decision dated December 25, 2025 to provide further clarification.
According to this decision:
- For data controllers keeping books on a balance sheet basis, both the number of employees and the annual financial balance sheet total must be assessed cumulatively when determining eligibility for exemption.
- For data controllers that do not keep books on a balance sheet basis, as no balance sheet total exists, only the number of employees shall be taken into account when assessing the exemption.
This clarification is particularly relevant for small and micro-sized enterprises, self-employed professionals, and data controllers operating under accounting methods other than the balance sheet basis. Such entities are advised to reassess their VERBIS obligations by taking into account their workforce size, accounting method, and data processing activities.
It should be noted that failure to register with VERBIS despite not meeting the exemption criteria may result in administrative fines under the Personal Data Protection Law.
You can access detailed information on the 2026 KVKK administrative fines here.
You can access the relevant public announcement here. (In Turkish)
Notification!
