VERBİS Registration in Turkey: Who Must Register and How

You are finalizing a bid for an important tender when a field on the buyer's supplier questionnaire stops you: VERBİS registration number. Your company has none, and the filing you kept postponing suddenly threatens your bid. If your organization processes personal data in Turkey, VERBİS registration is not paperwork you can defer. This guide explains who must register, how the process works, and how to keep the record current.

Turkish regulatory context: VERBİS (the Data Controllers' Registry Information System) is maintained by Turkey's data protection authority under KVKK, the local counterpart to the GDPR. Any organization that processes personal data in Turkey may fall under it, regardless of where its parent company is headquartered.

What Is VERBİS and Why It Matters

VERBİS is an official registry kept by Turkey's Personal Data Protection Authority. Under KVKK (Law No. 6698), data controllers that meet certain criteria must enroll. The filing is a public declaration summarizing which personal data you process and why.

Its core purpose is transparency. Data subjects can query the registry to see which data categories an organization processes, and the controller's trade name and contact details appear there too. That makes it both an oversight tool and a signal of trust that enterprise buyers and public tenders increasingly expect suppliers to prove.

The filing is not a standalone compliance certificate. Your VERBİS notification is a summary reflection of your personal data inventory, so no registration is possible without one first. Our KVKK and ISO 27001 compliance consulting runs the process from gap analysis to filing, and our KVKK compliance roadmap sets out the wider picture.

Who Must Register? Registration Criteria

The obligation is not identical for every company. The authority ties it to three tests: annual headcount, annual balance sheet, and the sensitivity of the data processed. The table below summarizes general criteria by controller type. Because thresholds are revised over time, confirm your case against the authority's current announcements.

Some controllers fall under exemptions: certain small businesses with narrow processing may be excused under specific conditions, but exemption is never automatic. The current list is on the Turkish data protection authority website.

The most frequent mistake is to look only at headcount. The three tests are weighed together, so even below the employee threshold, your balance sheet or the sensitivity of the data can still make registration mandatory. Where you are unsure, an independent compliance assessment is the safest route.

How to Register with VERBİS: Step by Step

The whole process runs online through the authority's VERBİS portal. You first create a data controller admin account, which becomes the hub for the notification, so start once your inventory is ready.

The registration steps run in this order:

1. Create the admin account: Open the data controller admin login on the portal.
2. Assign a contact person: Define who will track official notifications.
3. Start the notification form: Open a new registration filing.
4. Enter data categories: Select the personal data groups and processing purposes.
5. Define recipient groups: Mark the parties to whom data is transferred.
6. State retention periods: Enter a maximum retention period for each category.
7. Confirm the filing: Review everything and complete the registration.

Every field must match your data inventory exactly. Declare a category the inventory does not contain and an audit will expose the contradiction — the most overlooked part of the filing. If you also need to revisit your duty to inform, our guide to preparing a KVKK privacy notice walks through it screen by screen.

The Contact Person: Role and Responsibilities

In a VERBİS filing, the contact person handles communication between the authority and the data controller. This role does not legally represent the controller; it only receives and forwards notifications and holds no decision-making authority. Knowing this distinction matters for distributing responsibility correctly.

The contact person's main duties are:

• Tracking notifications from the authority.
• Routing data subject requests to the relevant unit.
• Monitoring that registry details stay current.

For individual data controllers, the person may take the role themselves; in legal entities, an employee from compliance, legal, or IT is usually assigned. Contact details must stay accurate, and when the contact person changes, the registry must be updated without delay. Assigning a contact person does not shift all responsibility onto one employee, so data subject requests are best anchored in a written procedure that survives staff turnover.

Keeping Your Registration Current

VERBİS registration is not a one-and-done task. When your processing activities change, the registry must change too, and the authority expects these updates within a set period.

Typical situations that require an update:

• A change in the personal data categories processed.
• A change in the parties data is transferred to.
• A change in the contact person's details.
• A revision of retention periods.

Proving that the technical measures you declared actually work is a separate obligation, demonstrated through continuous monitoring. Our managed SOC and MDR service keeps those measures running through a security operations center (SOC) and managed detection and response (MDR). In one 24-hour window at a single client, our ERBE SIEM operation recorded 262 attack attempts from 104 distinct IPs, peaking at 16 attempts per second. Keeping those logs on-premise with 0 cloud transfer matters here: logs that contain personal data must not leave the country without triggering a separate cross-border transfer regime.

Support the record with an annual review too, since processing activities shift unnoticed as new software creates new data flows. Neglecting updates is one of the most easily avoided gaps. When a breach occurs, a separate notification process applies, and our KVKK data breach notification guide summarizes the steps.

Conclusion

VERBİS registration begins with assessing whether you must register, rests on a data inventory, proceeds step by step, and must be kept current. Rather than filing once and forgetting it, review the record whenever your processing activities change. To plan this from gap analysis through filing, explore our KVKK and ISO 27001 compliance consulting.

Frequently Asked Questions

What is the penalty for failing to register with VERBİS?

KVKK provides administrative fines for data controllers that ignore the registration obligation. The amounts are revalued each year, so confirm the current figure through the authority's announcements. Beyond the fine, a missing registration also causes reputational loss in tenders and corporate partnerships, where buyers increasingly ask suppliers for a valid registry number before they sign a contract.

Is the VERBİS contact person the same as the data controller representative?

No, the two roles differ. The contact person only handles communication with the authority and forwards notifications; they do not legally represent the controller. The data controller representative is a broader, more empowered role defined mainly for controllers established abroad. In small and mid-sized domestic companies, usually only a contact person is appointed.

How quickly must VERBİS details be updated after a change?

When the details you declared change, the update must be made within the period the authority sets. A new data category, a new transfer recipient, or changed contact details all fall in scope. Confirm the current time limits through the authority's announcements. Not delaying changes is the most practical way to reduce audit inconsistency and possible penalty risk.