Pursuant to Article 16(2) of the Law No. 6698 on the Turkish Personal Data Protection Law (“KVKK”), natural and legal persons who process personal data are required to register with the Data Controllers’ Registry Information System (“VERBİS”) prior to commencing data processing activities. However, the Personal Data Protection Board (“Board”) may introduce exemptions to this obligation by taking certain objective criteria into account.
In this context, under the Board Decision dated 04.09.2025 and numbered 2025/1572, as amended by the Board Decision dated 19.07.2018 and numbered 2018/87;
- data controllers whose annual number of employees is fewer than 50 and whose annual financial balance sheet total is less than TRY 100 million, and whose main activity does not involve the processing of special categories of personal data, and
- data controllers whose main activity involves the processing of special categories of personal data, but whose annual number of employees is fewer than 10 and whose annual financial balance sheet total is less than TRY 10 million,
are exempted from the obligation to register with VERBİS.
In opinion requests submitted to the Personal Data Protection Authority (“Authority”), it has been stated that the information regarding the “annual financial balance sheet total” is only available for taxpayers who keep their books on a balance sheet basis, whereas such information does not exist for data controllers who keep their books on an operating account basis. Accordingly, uncertainties have arisen as to how the exemption criteria should be applied to such data controllers.
With its Decision dated 25.12.2025 and numbered 2025/2393, the Board has resolved as follows:
- For data controllers who keep their books on a balance sheet basis, both the “annual number of employees” and the “annual financial balance sheet total” criteria shall be taken into account cumulatively in the assessment of the exemption from the VERBİS registration obligation.
- For data controllers who do not keep their books on a balance sheet basis, since there is no information available regarding the annual financial balance sheet total, only the “annual number of employees” criterion shall be taken into account in the exemption assessment.
It is of importance for data controllers to reassess their obligations within the scope of this decision by taking into consideration their number of employees and fields of activity.
The full text of the public announcement published by the Personal Data Protection Authority may be accessed in Turkish via the link below:
For detailed information and professional support during the compliance process, feel free to contact us.
This Legal Alert has been prepared for general information purposes only on current legal issues, and the evaluations contained in this Legal Alert do not constitute legal advice or a legal opinion. It is not possible to impose any liability on SRP-Legal Law Office due to the content of this Legal Alert. It is recommended to obtain the opinion of a legal advisor regarding your questions and enquires within the scope of this Legal Alert.
