VERBIS Registration Mandatory Exceptions Changed

The Personal Data Protection Board has adopted certain criteria for granting an exemption from the obligation to register with VERBIS, taking into account Article 16 of the Personal Data Protection Law No. 6698 and Articles 8 and 16 of the Regulation on the Data Controllers Registry. Within the scope of the Personal Data Protection Board's Decision No. 2018/87 dated 19/07/2018 regarding "Data Controllers to be Exempted from the Obligation to Register with the Data Controllers Registry," it is envisaged that natural or legal person data controllers with fewer than 50 employees and an annual financial balance sheet total of less than 25 million Turkish lira, whose main activity is not the processing of special personal data, will be exempted from the obligation to register with the Registry.

In 2023 , this criterion was updated with the update of the total annual financial balance sheet amount as " real or legal person data controllers whose annual number of employees is less than 50 and whose annual financial balance sheet total is less than 100 million Turkish Lira and whose main activity is not the processing of special personal data ".

Within the scope of the KVK Board decision numbered 2025/1572 and dated 04.09.2025, published on 1 October 2025, the scope of this exemption has been expanded and an exemption from the obligation to register with VERBIS has been introduced for " real and legal person data controllers whose main activity is processing special personal data, whose annual number of employees is less than 10 and whose annual financial balance sheet total is less than 10 million Turkish lira ".

The final version of the mentioned criterion is as follows:

• Natural or legal person data controllers whose annual number of employees is less than 50 and whose annual financial balance sheet total is less than 100 million Turkish Lira and whose main activity is not the processing of special personal data.

• Real or legal person data controllers whose main activity is processing special categories of personal data, but whose annual number of employees is less than 10 and whose annual financial balance sheet total is less than 10 million Turkish Lira.

You can access the published decision from here.