Data Protection Update: VERBİS Registration Exemption for Special Category Data Controllers
The Personal Data Protection Board (“Board”) has issued a decision, published in the Official Gazette on 1 October 2025 (No. 33034), which expands the exemption criteria for the obligation to register and notify the Data Controllers’ Registry Information System (“VERBİS”). This decision specifically affects data controllers whose primary activity involves processing special categories of personal data. You may read the full text of the Board’s decision and announcement here.
Previously, under the Board’s decision dated 6 July 2023 (No. 2023/1154), which amended the earlier decision of 19 July 2018 (No. 2018/87), data controllers were exempt from the VERBİS registration and notification obligation if they:
(i) Employed fewer than 50 people annually;
(ii) Had a total annual financial balance sheet of less than TRY 100 million; and
(iii) Did not process special categories of personal data as part of their main area of activity.
However, data controllers whose main activity involved processing special categories of personal data were required to register with VERBİS regardless of their employee count or financial balance sheet.
The Board’s latest decision, dated 4 September 2025, introduces a new exemption criterion for data controllers whose primary activity involves processing special categories of personal data. Under this decision, data controllers are now exempt from the VERBİS registration and notification obligation if they:
(i) Employ fewer than 10 people annually; and
(ii) Have a total annual financial balance sheet of less than TRY 10 million.
This expansion of the exemption criteria aims to simplify compliance requirements for small businesses, such as pharmacies, doctors’ offices, dietitians, and physiotherapists. Consequently, data controllers meeting these thresholds are no longer required to register with VERBİS, even if their primary activity involves processing special categories of personal data.
For further information and support, please contact us.
Previously, under the Board’s decision dated 6 July 2023 (No. 2023/1154), which amended the earlier decision of 19 July 2018 (No. 2018/87), data controllers were exempt from the VERBİS registration and notification obligation if they:
(i) Employed fewer than 50 people annually;
(ii) Had a total annual financial balance sheet of less than TRY 100 million; and
(iii) Did not process special categories of personal data as part of their main area of activity.
However, data controllers whose main activity involved processing special categories of personal data were required to register with VERBİS regardless of their employee count or financial balance sheet.
The Board’s latest decision, dated 4 September 2025, introduces a new exemption criterion for data controllers whose primary activity involves processing special categories of personal data. Under this decision, data controllers are now exempt from the VERBİS registration and notification obligation if they:
(i) Employ fewer than 10 people annually; and
(ii) Have a total annual financial balance sheet of less than TRY 10 million.
This expansion of the exemption criteria aims to simplify compliance requirements for small businesses, such as pharmacies, doctors’ offices, dietitians, and physiotherapists. Consequently, data controllers meeting these thresholds are no longer required to register with VERBİS, even if their primary activity involves processing special categories of personal data.
For further information and support, please contact us.
Download PDF
k.bas@lbfpartners.com
