VERBIS Registration Requirement: Announcement on Joint Ventures, Consortia and Ordinary Partnerships
In the public announcement published by the Turkish Personal Data Protection Authority on 16 March 2026, clarifications were provided regarding the notification of personal data processing activities carried out within the scope of joint ventures, consortia, and ordinary partnerships to the Data Controllers' Registry (VERBIS), addressing uncertainties encountered in practice.
The announcement recalls the Decision of the Personal Data Protection Board dated June 9, 2021 and numbered 2021/569 (In Turkish), stating that joint ventures, consortia, and ordinary partnerships do not possess a separate legal personality; therefore, they cannot register with VERBIS in their own name.
According to the approach adopted by the Board, the parties forming such partnerships must first be assessed individually in terms of their status as data controllers and their obligation to register with VERBIS. Where the partners are subject to VERBIS registration requirements, they must, during their registry registration process, also declare the personal data processing activities carried out within the scope of the partnership, in addition to their own processing activities.
As a result of the Authority's examinations, it was determined that certain joint ventures, consortia, and ordinary partnerships had applied for registration in the Registry in their own names. Accordingly, the Authority considered it necessary to reiterate the principles established under the aforementioned Board decision.
Key Criteria for VERBIS Registration Obligations
The obligation to register with VERBIS is determined under the Law No. 6698 on the Protection of Personal Data and the Regulation on the Data Controllers' Registry, depending on the nature of the data controller. Meeting at least one of the criteria below is sufficient for the obligation to arise:
| Type of Data Controller | Number of Employees | Annual Financial Balance Sheet | Special Condition | VERBIS Obligation |
|---|---|---|---|---|
| Data controllers established in Türkiye | 50 employees or more | Annual balance sheet TRY 100 million or more | - | VERBIS registration required |
| Data controllers whose main activity involves processing special categories of personal data | 10 employees or more | Annual balance sheet TRY 10 million or more | Main activity involves sensitive data such as health data, biometric data, etc. | VERBIS registration required |
| Data controllers established abroad | No threshold | No threshold | Processing personal data in Türkiye | Appointment of a Data Controller Representative and VERBIS registration required |
| Public institutions and organizations | No threshold | No threshold | - | VERBIS registration required |
Accordingly, where personal data processing takes place within the scope of activities carried out by joint ventures, consortia, or ordinary partnerships, the VERBIS registration obligation must not be assessed based on the partnership structure itself, but rather based on the data controller status of each partner and the criteria summarized above.
Therefore, if any of the partners forming the partnership is subject to a VERBIS registration obligation, the relevant data controller must also include in its own Registry record the personal data processing activities carried out within the scope of the partnership.
With the recent announcement made by the Personal Data Protection Authority, it appears that the principles established by the Board Decision dated June 9, 2021 and numbered 2021/569 have once again been emphasized. Accordingly, it is important for data controllers to review whether personal data processed within the scope of joint venture, consortium, or ordinary partnership activities are accurately and completely reflected in their VERBIS records.
You may access the relevant announcement here. (In Turkish)
Should you have any queries, please contact us.
-
-
Notification!
