VERBİS Registration
& Management
The Data Controllers Registry (VERBİS) is the most rigorously enforced obligation under Turkish privacy law. Evade multi-million Lira administrative fines with our 30+ years of legal expertise in Data Inventory mapping and continuous registry management.
The Anatomy of VERBİS
Unlike the EU GDPR, which largely abolished centralized registration requirements, Turkey's Personal Data Protection Law (KVKK) mandates a highly regulated, public-facing database known as VERBİS (Veri Sorumluları Sicil Bilgi Sistemi).
VERBİS is not a simple form you fill out and forget. It is the architectural blueprint of your entire organizational compliance. When the Personal Data Protection Board (Kurul) investigates a complaint against your company, their very first action is to pull your VERBİS record. If a data subject complains that you process their health data, and your VERBİS entry does not declare the processing of "Health Data," the Board will issue an immediate administrative fine for registry violations, regardless of whether the processing itself was lawful.
Thresholds: Who Must Register?
The obligation to register is binary and strictly enforced. Under the decisions published by the KVKK Board, the following entities are mandated to register:
- ALL Foreign Data Controllers: If you are established outside of Turkey but process the personal data of individuals in Turkey, you have zero exemptions. You must register regardless of your revenue or employee count.
- Turkish Companies (Size Threshold): Any company established in Turkey with more than 50 employees OR an annual financial balance sheet exceeding 50 Million Turkish Liras (TRY).
- Special Category Data Processors: Turkish companies whose main business activity is processing special categories of personal data (e.g., hospitals, pharmacies, clinics, certain tech companies), regardless of employee or financial thresholds.
Statutory Framework & Administrative Fines
Relevant Turkish Legislation
- KVKK Law No. 6698, Article 16:
"Natural or legal persons who process personal data must register with the Data Controllers Registry before commencing processing." - Regulation on the Data Controllers Registry, Article 5:
Mandates the creation of a Personal Data Processing Inventory (Veri Envanteri) prior to VERBİS registration. - KVKK Law No. 6698, Article 18 (Administrative Fines):
Those who fail to comply with the registry obligation face severe financial penalties. The Board frequently utilizes its authority to issue fines reaching the statutory maximums (which exceed millions of TRY due to annual revaluation).
The Prerequisite: The Data Inventory (Veri Envanteri)
The most common error organizations make is attempting to log into VERBİS and guess the answers. Legally, you cannot register in VERBİS without first constructing a Personal Data Processing Inventory (Kişisel Veri İşleme Envanteri).
The Inventory is a massive, granular, department-by-department mapping of your data flows. It must document: the data category (e.g., Identity, Financial), the purpose of processing (e.g., Execution of Contract), the legal basis under Article 5 or 6, the maximum retention period, the recipient groups (e.g., suppliers, public authorities), the foreign transfer mechanisms, and the technical/administrative security measures (Article 12).
VERBİS is simply the distillation of this Inventory. If the foundational Inventory is legally flawed, your public VERBİS declaration becomes a formalized confession of non-compliance to the regulator.
Is Your VERBİS Record Accurate?
Article 13 requires you to update VERBİS within 7 days of any change. If your record hasn't been updated since 2020, you are non-compliant.
Request a VERBİS AuditOur 30-Year Execution Methodology
We deploy decades of Turkish legal authority to ensure your VERBİS footprint is impenetrable.
Forensic Departmental Audits
We do not rely on questionnaires. We interview HR, IT, and Marketing to uncover shadow IT and undocumented data flows, ensuring zero omissions.
Inventory Construction (Envanter)
We construct the mandatory Article 5 Inventory, applying rigorous Turkish legal categorizations to your data processing activities.
Representative & Contact Person Designation
For foreign entities, we act as your Notarized Representative. For domestic entities, we train and advise your designated Contact Person (İrtibat Kişisi).
System Entry & Continuous Maintenance
We execute the complex matrix uploading into the state portal and monitor your operations quarterly to execute the mandatory 7-day updates under Article 13.
Frequently Asked Questions
Expert legal answers regarding the Data Controllers Registry.
What is VERBİS?
VERBİS (Veri Sorumluları Sicil Bilgi Sistemi) is the Data Controllers Registry Information System in Turkey. It is a publicly accessible, government-mandated database where data controllers must declare categorical information about the personal data they process.
Who is required to register with VERBİS?
Under the KVKK, registration is mandatory for: 1) ALL foreign data controllers regardless of size; 2) Turkish companies with more than 50 employees OR an annual financial balance sheet exceeding 50 million TRY; and 3) Turkish companies whose main activity is processing special categories of personal data (health, biometric, etc.), regardless of size.
What happens if we do not register with VERBİS?
Failure to fulfill the registry obligation is heavily penalized. Under Article 18 of the KVKK, the Board issues administrative fines that scale annually with the Revaluation Rate (Yeniden Değerleme Oranı). Fines routinely reach millions of Turkish Liras. The Board may also suspend your right to process data.
Do we upload actual personal data (names, emails) to VERBİS?
No. You only upload categorical data. For example, instead of uploading John Doe's email, you declare that you process 'Contact Information' belonging to the 'Customer' category for the purpose of 'Marketing', and that it is retained for '5 years'.
What is a Personal Data Processing Inventory (Veri Envanteri)?
Before you can register with VERBİS, you must legally construct a 'Veri Envanteri' (Data Inventory). This is an exhaustive internal Excel/software document mapping every single data flow, legal basis, and retention period in your company. VERBİS is simply the public summary of this inventory.
How does a foreign company register?
A foreign company cannot log into VERBİS directly. They must first appoint a 'Data Controller Representative' (Veri Sorumlusu Temsilcisi) located in Turkey through a notarized resolution. The representative then uses their e-Government (e-Devlet) credentials to register the foreign company.
Is VERBİS a one-time process?
No. Article 13 of the Regulation on the Data Controllers Registry requires you to update VERBİS within 7 days of any change in your processing activities. Static registries that do not match real-world processing invite KVKK Board audits.
What is the role of the 'İrtibat Kişisi' (Contact Person)?
For Turkish companies, the Board requires the designation of a Contact Person (a Turkish citizen). This person physically makes the data entry into the system on behalf of the corporate Data Controller. Foreign companies use their Representative for this function.
Avoid Costly Administrative Fines
VERBİS is heavily monitored by the Authority. Entrust your data inventory and public registry management to the absolute authority in Turkish Data Protection law.
Book a Registry ConsultationDisclaimer: This content is for informational purposes only and does not constitute legal advice or create an attorney-client relationship. Turkish data protection regulations (Law No. 6698) and Board precedents are subject to change. Please consult directly with our legal team for tailored counsel.