Mevzuat Kategorileri
Hukuksal Düzenlemeler
Türkiye’de Kişisel Verilerin Korunması Kanunu, Sosyal Güvenlik Hukuku, Vergi Hukuku, İş Sağlığı ve Güvenliği Mevzuatı, Borçlar Hukuku, İş Hukuku, Ticaret Hukuku, Türk Parası Kıymetini Koruma Mevzuatı, Kambiyo Mevzuatı ve Vatandaşlık ve Göçmenlik Mevzuatı ile ilgili en güncel bilgilerin yer aldığı makalelere buradan ulaşabilirsiniz.
İkili Anlaşmalar
Türkiye ve diğer ülkeler arasında yapılan en güncel uluslararası ikili sosyal güvenlik ve vergi anlaşmalarının tarihlerine ve dokümanlarına buradan ulaşabilirsiniz.
03 Ekim 2025
Yazar Ecem Kumsal Başyurt, Kategori KVKK - GDPR
With the Decision of the Personal Data Protection Board published in the Official Gazette dated October 1, 2025 and numbered 33034, amendments have been made to the exemption criteria regarding the obligation to register with VERBİS (Data Controllers' Registry Information System), which is carried out pursuant to Article 16 of the Law on the Protection of Personal Data No. 6698.
In the current practice, natural or legal person data controllers with fewer than 50 employees annually and an annual financial balance sheet total of less than 100 million Turkish lira, whose primary field of activity is not the processing of sensitive personal data, were exempt from the obligation to register with VERBİS.
With the Board Decision, in addition to the above-mentioned provision, an additional exemption criterion has been introduced for data controllers whose main field of activity involves sensitive personal data. Data controllers whose main field of activity is processing of sensitive personal data are exempt from the obligation to register with VERBIS under the relevant Board Decision, provided that they meet the following criteria:
This decision is of particular importance for micro-scale enterprises providing health, consultancy, therapy, beauty, and personal care services. In this context, businesses must review their VERBİS obligations by taking into account their number of employees and balance sheet size. It should be noted that data controllers who do not meet the criteria and fail to register may face administrative fines.
You can access detailed information on the 2026 KVKK administrative fines here.
You can access the relevant Official Gazette text here. (In Turkish)
Notification!
The content in this article is for general information purposes only and belongs to CottGroup® member companies. This content does not constitute legal, financial, or technical advice and cannot be quoted without proper attribution.
CottGroup® member companies do not guarantee that the information in the article is accurate, up-to-date, or complete and are not liable for any damages that may arise from errors, omissions, or misunderstandings that the information may contain.
The information presented here is intended to provide a general overview. Each specific case may require different assessments, and this information may not be applicable to every situation. Therefore, before taking any action based on the information provided in the article, it is strongly recommended that you consult a competent professional in the relevant fields such as legal, financial, technical, and other areas of expertise. If you are a CottGroup® client, do not forget to contact your client representative regarding your specific situation. If you are not our client, please seek advice from an appropriate expert.
To reach CottGroup® member companies, click here.
About The Author
https://www.cottgroup.com
What Is the Right to Erasure? GDPR, Turkish Data Protection Law (KVKK), and Back-Up Compliance in Light of the EDPB Report
Ecem Kumsal Başyurt
23 Mart 2026
28 January Data Protection Day
CottGroup Hukuk ve Mevzuat Ekibi
27 Ocak 2022
Standard Contract Notification Obligation and Penalties
18 Kasım 2024
Data Transfer within the Scope of KVKK and GDPR
Taylan Ege Günel
4 Aralık 2023