Clarification on the Application Principles of VERBİS Registration Exemptions

Under the Board's decision dated 4 September 2025, the scope of exemptions was expanded. Accordingly:

• Data controllers whose main activity is not the processing of special categories of personal data continue to benefit from the existing exemption and
• An additional exemption was introduced for micro-scale data controllers whose main activity involves the processing of special categories of personal data.

In this context, data controllers whose main activity involves the processing of special categories of personal data are exempt from VERBIS registration provided that they meet both of the following criteria:

• Fewer than 10 employees, and
• An annual financial balance sheet total of less than TRY 10 million.

However, in practice, questions arose as to how the "annual financial balance sheet total" criterion should be interpreted for data controllers that do not keep accounting records on a balance sheet basis. In response to these concerns, the Board issued its decision dated December 25, 2025 to provide further clarification.

According to this decision:

• For data controllers keeping books on a balance sheet basis, both the number of employees and the annual financial balance sheet total must be assessed cumulatively when determining eligibility for exemption.
• For data controllers that do not keep books on a balance sheet basis, as no balance sheet total exists, only the number of employees shall be taken into account when assessing the exemption.

This clarification is particularly relevant for small and micro-sized enterprises, self-employed professionals, and data controllers operating under accounting methods other than the balance sheet basis. Such entities are advised to reassess their VERBIS obligations by taking into account their workforce size, accounting method, and data processing activities.

It should be noted that failure to register with VERBIS despite not meeting the exemption criteria may result in administrative fines under the Personal Data Protection Law.

You can access detailed information on the 2026 KVKK administrative fines here.

You can access the relevant public announcement here. (In Turkish)