VERBIS Registration and Notification Procedures

After corporate and income tax returns have been filed, data controllers meeting any of the criteria below will become subject to registration and notification obligations in the Data Controllers' Registry Information System (VERBIS).

As is known, data controllers satisfying the financial criteria determined by the Turkish Data Protection Board must register with VERBIS. VERBIS is the registry in which data controllers register and declare information concerning their personal data processing activities.

It is sufficient for a natural or legal person acting as data controller to meet any one of the following criteria.

First criterion:

• The annual number of employees exceeds 50. The calculation must relate to a completed year. The employee count reported by the data controller in the monthly Withholding and Premium Service Return submitted to the competent public authorities must exceed the threshold in at least seven of the twelve months in that year. Those seven months do not need to be consecutive, provided they fall within the same year. Data controllers that had not previously registered with VERBIS but met this criterion in 2023 were therefore required to register and submit a notification.

Second criterion:

• The second criterion concerns the annual balance-sheet total. Following an increase introduced by a Board decision in 2023, natural and legal persons with an annual balance-sheet total exceeding TRY 100 million were required to register with VERBIS. The calculation must relate to a completed year and uses the balance-sheet information in the financial statements attached to the income or corporate tax return submitted annually to the competent public authority. For data controllers keeping books on a balance-sheet basis, the Board considers the total shown under either assets or liabilities in that return. Turnover and net or gross sales revenue are not taken into account. Data controllers that had not previously registered but met this criterion in 2023 were therefore required to register and submit a notification.

Third criterion:

• Newly established natural and legal persons whose principal activity involves processing special categories of personal data. Data controllers meeting this criterion must register and notify VERBIS regardless of the relevant accounting period.

Natural and legal persons processing personal data as controllers within this scope must register and notify VERBIS. Where the obligation arises from a financial criterion, registration must be completed within 30 days after the relevant income or corporate tax return is filed.

Article 16 of the KVKK authorises the Board to create exemptions from VERBIS registration by reference to objective criteria. The natural and legal persons included within exemptions by Board decisions include:

• Persons who process personal data only by non-automatic means, provided that the processing forms part of a data filing system,
• Notaries practising under Notary Law No. 1512,
• Associations established under Associations Law No. 5253, foundations established under Foundations Law No. 5737, and trade unions established under Trade Unions and Collective Bargaining Agreements Law No. 6356, where they process personal data solely in line with the relevant legislation and their purposes, within their field of activity, and only in relation to their employees, members, affiliates and donors,
• Political parties established under Political Parties Law No. 2820,
• Lawyers practising under Attorneyship Law No. 1136,
• Customs brokers,
• Mediators,
• Certified public accountants and sworn-in certified public accountants practising under Law No. 3568.