Do you have to register with VERBIS?

The VERBIS registration obligation means that data controllers covered by KVKK (Türkiye's Personal Data Protection Law) must register with VERBIS (Türkiye's data controller registry) and submit a summary of their personal data inventory. As a rule, the Law places all data controllers under the obligation to register. However, over the years the Personal Data Protection Board has exempted certain groups from this obligation through its decisions. This is exactly where most companies get confused: "Are we exempt?" and "If we're exempt, don't we have to do anything else?" In this article we address both questions.

What is VERBIS and what is it for?

VERBIS is the online registry where a data controller publicly declares which categories of personal data it processes, for what purposes, to whom it transfers them, how long it keeps them and what security measures it takes. Applications and registrations are made through the Authority's VERBIS system.

The real work behind registration is preparing a personal data inventory. The inventory is an internal table showing which department processes which data, in which process and on which legal ground. The information entered into VERBIS is a summary of this inventory. A registration made without an inventory turns into a declaration that doesn't reflect reality.

Who has been exempted? Reading the exceptions correctly

Of the exemptions introduced by Board decisions, the one that affects the largest number of businesses is based on employee count and total annual balance sheet. The general logic is this:

• The annual number of employees is below a certain figure and
• The total annual balance sheet is below the amount set by the Board and
• The main field of activity is not processing special categories of personal data

Individuals and legal entities meeting these conditions are exempt from registration. All three conditions must be met together. The employee threshold is applied as 50; the balance sheet threshold, on the other hand, has been raised over time by Board decisions. We recommend checking the current amount in the latest VERBIS decisions on the Authority's website and confirming your own situation with your financial advisor and legal counsel.

In addition, the Board has granted exemptions by decision to certain professions and organizations due to the nature of their activities (for example, notaries, associations and foundations under certain conditions, and some self-employed professions). Verify whether your profession is on this list using the Authority's relevant decisions.

A point to watch: The phrase "main activity is processing special categories of data" is particularly relevant to healthcare. A small clinic or laboratory may be obliged to register because of this condition even if it has few employees. We cover the healthcare side in our digital guide for clinics.

What doesn't the exemption change?

The VERBIS exemption only removes the obligation to register with the registry. The following apply equally to exempt companies:

So even if a small company doesn't register, it must take the same care with its website forms, employee files and customer records. We explained the privacy notice side in our article on a privacy notice for your website.

What to do if you are required to register

1. Prepare the inventory. Department by department, write down the processes, data categories, purposes, retention periods and the parties data is transferred to.
2. Prepare a retention and destruction policy. Under the relevant regulation, data controllers on the registry are expected to prepare a personal data retention and destruction policy.
3. Appoint a contact person. The person who will handle communication with the Authority is defined in the registry.
4. Complete the registration. The summary of the inventory is entered into VERBIS.
5. Keep it up to date. The registration must be updated whenever a new system, a new supplier or a new processing purpose appears.

The fifth step is the one that slips most often. Registration is done once and forgotten; three years later half of the company's systems have changed, but the registry still shows the old picture.

The technical team's role in the inventory

The inventory is usually left to HR and the legal team. Yet the people who know best where data actually lives are those who build and run the systems: which database is on which server, where backups go, which integration carries which field out. A table prepared without the technical side usually misses the copies in backups and the data that multiplies through integrations.

How we do it at Globya

For the websites, portals and software we build, we prepare a technical data map documenting which data sits in which table, which backup and which integration. This map becomes the most concrete resource in the hands of the legal team preparing your inventory. We encode retention periods into the software as rules and automate the deletion or anonymization of records whose retention period has expired. Our general approach is on the our approach to KVKK page; these requirements are never left out of our projects, and there is no extra charge.

Frequently asked questions