What Is VERBIS? Turkey's Data Controllers Registry and Who Must Register in 2026

If your company does business in Turkey — through a local subsidiary, a branch, or simply by serving Turkish customers — sooner or later a contract negotiation, a vendor audit or a lawyer will ask the same question: "Is your VERBIS registration in place?" This guide explains what the registry is, who must register under the 2026 rules, and what the registration actually commits you to.

What VERBIS Is

VERBIS (short for the Turkish name of the Data Controllers Registry Information System) is the online registry operated by Turkey's Personal Data Protection Authority. Its legal basis is Article 16 of the KVKK, Turkey's data protection law: natural and legal persons who process personal data must enrol in the registry before processing begins, unless they fall under an exemption defined by the Board.

Registration is a structured declaration: which categories of personal data you process, for which purposes, how long you retain them, which recipient groups you transfer them to, whether data leaves Turkey, and which security measures you apply. A summary of that declaration is publicly searchable — customers, competitors and auditors can look your entry up. VERBIS is therefore less a formality and more the public face of your data-processing practice.

Who Must Register in 2026?

The obligation is defined by Board decisions, and the thresholds have been revised over the years. Under the current framework there are four doors into the obligation:

Trigger	Criterion	Typical example
Headcount	More than 50 employees annually	A manufacturer with 55 staff
Financial size	Annual balance sheet total above 100 million TRY	A 30-person wholesaler with a large balance sheet
Sensitive data	Core business is processing special categories of data — no size threshold	Private clinics, occupational-health providers, laboratories
Foreign controllers	Data controllers established abroad that process personal data in Turkey — no size threshold	A foreign SaaS company serving users in Turkey

For the two threshold-based doors, meeting either criterion is enough. For the sensitive-data door, size is irrelevant: a three-person counselling practice is obliged to register because health data is its core business.

The Rule Foreign Companies Miss

The provision with the most practical consequences for international readers is the fourth one: a data controller established outside Turkey that processes personal data of people in Turkey falls under the registration obligation regardless of employee count or balance sheet, and must appoint a data controller representative in Turkey — a local point of contact registered in VERBIS. Market entry checklists built purely around GDPR often miss this step, because the GDPR has no directly equivalent public registry. If Turkey is a real market for your product, VERBIS registration belongs on the same checklist as tax registration.

Who Is Exempt?

Board decisions exempt several groups, including lawyers, notaries, mediators and customs brokers acting within their professional activity; associations, foundations and trade unions processing data only for their members and staff under their own legislation; and political parties. Businesses below the thresholds whose core activity is not sensitive-data processing are also outside the registration obligation.

The most common misunderstanding: exemption from the registry is not exemption from the law. The KVKK's substantive duties — informing data subjects, securing the data, answering data-subject requests, reporting breaches — apply to every controller, registered or not. VERBIS is the declaration layer, not the compliance itself.

What Non-Registration Costs

Failure to register and declare is an administrative offence under Article 18 of the KVKK. Fine amounts are revalued every year and reach into the millions of Turkish lira; on the data-security side of the law, 2026 upper limits approach 17 million TRY. Exact current figures are published annually by the Authority. The indirect cost is often felt sooner than the fine: in vendor security audits and public tenders, a missing VERBIS registration can be a single-line disqualifier.

The Real Work Behind the Form: the Data Inventory

The VERBIS declaration is a summary of your personal-data processing inventory. Without the inventory, the form either cannot be completed or degenerates into a copy-paste declaration that does not match reality — and a declaration that contradicts your actual practice is harder to defend in an audit than a late registration. Building the inventory is mostly technical discovery work:

• Which systems hold personal data? (ERP, CRM, email, file servers, HR software, CCTV, access-control systems)
• Where does the data physically live? (on-premises servers, Turkish data centres, foreign cloud regions)
• Who can access it, and which security controls apply? (permissions, encryption, backups, logging)
• How long is it retained, and what happens at the end of the period?
• Which third parties receive it? (accountants, couriers, messaging providers, foreign SaaS tools)

Where Yamanlar Bilişim Fits

The legal side of the declaration — legal bases, privacy notices, the wording of the registry entry — belongs to your counsel or KVKK consultant. Yamanlar Bilişim covers the technical side beneath it: a VERBIS technical readiness inventory that maps where personal data actually lives in your infrastructure, who can reach it, how it is protected and where it flows. The output serves two purposes: an accurate foundation for the registry declaration, and a concrete list of security findings — unencrypted shares, over-broad permissions, forgotten legacy systems — that is usually worth more than the registration itself.

FAQ