Changes in Exceptions to the Obligation to Register with VERBİS
With the Decision of the Personal Data Protection Board published in the Official Gazette dated October 1, 2025 and numbered 33034, amendments have been made to the exemption criteria regarding the obligation to register with VERBİS (Data Controllers' Registry Information System), which is carried out pursuant to Article 16 of the Law on the Protection of Personal Data No. 6698.
In the current practice, natural or legal person data controllers with fewer than 50 employees annually and an annual financial balance sheet total of less than 100 million Turkish lira, whose primary field of activity is not the processing of sensitive personal data, were exempt from the obligation to register with VERBİS.
With the Board Decision, in addition to the above-mentioned provision, an additional exemption criterion has been introduced for data controllers whose main field of activity involves sensitive personal data. Data controllers whose main field of activity is processing of sensitive personal data are exempt from the obligation to register with VERBIS under the relevant Board Decision, provided that they meet the following criteria:
- Data controllers, natural or legal persons with fewer than 10 employees annually,
- With an annual financial balance sheet total of less than 10 million Turkish lira.
This decision is of particular importance for micro-scale enterprises providing health, consultancy, therapy, beauty, and personal care services. In this context, businesses must review their VERBİS obligations by taking into account their number of employees and balance sheet size. It should be noted that data controllers who do not meet the criteria and fail to register may face administrative fines.
You can access detailed information on the 2025 KVKK administrative fines here.
You can access the relevant Official Gazette text here. (In Turkish)
-
-
Notification!
