TOOL · 03
VERBİS Registration Check
As a data controller, must you register with VERBİS (the Data Controllers’ Registry)? Answer a few questions to find out, based on the current exemption thresholds in Board Decision 2025/1572. Your answers never leave your device.
For information only; not legal advice. Specific cases should be assessed individually, and the Board decides on exemptions.
FAQ
About VERBİS registration
Do I have to register with VERBİS?
For natural and legal persons who process personal data, the rule is to register before processing begins (Council of State, 10th Chamber, 11 June 2024). The exemption is narrow: in the private sector, controllers with fewer than 50 employees and an annual balance-sheet total below ₺100m, whose main activity is not processing sensitive data, fall within the scale exemption (where the main activity is sensitive-data processing, the threshold is 10 employees and ₺10m). Controllers established abroad and public institutions must register in all cases.
Which professions and bodies have a Board exemption?
By Board decisions, customs brokers and authorised customs brokers (2018/68) and mediators (2018/75) are within the exemption. For associations, foundations and trade unions there is a limited exemption tied to their field of activity, purpose and data-subject group (2018/32, 2019/353, 2020/315). Outside this narrow frame, an exemption cannot be presumed on the basis of a professional title alone.
Can I decide for myself that I am exempt?
No. Under the Council of State 10th Chamber decision of 11 June 2024, an exemption must either fall within a published Board decision or be assessed by the Board on the facts — and that assessment rests on objective criteria such as the nature and volume of the data, the purpose of processing, the field of activity, transfers to third parties, retention periods and employee count / balance sheet. The request must be assessed by the Board rather than by an administrative unit.
Is filing an application enough for registration?
No. Under Board decision 2019/387, merely submitting the application form does not fulfil the obligation; the notification must be completed in the system and the declarations (processing purposes, data categories, recipient groups, transfers abroad, retention periods) must be accurate, current and consistent with the actual processing practice.
Does exemption mean exemption from KVKK compliance?
No. The exemption concerns only the VERBİS registration obligation. All other KVKK obligations — data security, the privacy notice, explicit consent and breach notification — continue to apply. VERBİS should be treated as part of a broader corporate compliance programme.