How can we help you to register with Data Controllers' Registry Information System (VERBIS)?

Natural and legal persons who process personal data must register with Data Controllers' Registry Information System (VERBIS) before processing personal data. Criteria such as number of employees and annual financial balance should be taken into consideration for this obligation.

STARTING DATES AND DEADLINES FOR VERBIS REGISTRATION ANNOUNCED BY THE TURKISH PERSONAL DATA PROTECTION BOARD ACCORDING TO THE PROVISIONAL ARTICLE 1 (*) OF THE LAW NUMBERED 6698

Data Controllers

Start Date of Registration Obligation

Period of Time Given for Registration

Deadline for Registration 

Natural and legal person data controllers with an annual number of employees of more than 50 or annual financial balance of more than 25 million TL

01.10.2018

24 months

30.09.2020

Natural and legal person data controllers resident abroad 

01.10.2018

24 months

30.09.2020

Natural and legal person data controllers with an annual number of employees of less than 50 or annual financial balance of less than 25 million TL and whose main activity is sensitive personal data processing

01.10.2019

27 months

31.03.2021

Public institutions and organizations

01.04.2019

24 months

31.03.2021

Note: This decision regulates the registration period for VERBIS system. The process of delays and new disclosures should be followed.

Decision of the Turkish Personal Data Protection Board dated 19/07/2018 and numbered 2018/88 on "Starting Dates of the Obligation to Register"

Date of Decision

: 19/07/2018

Decision No

: 2018/88

Abstract

: Starting dates of registration obligation

The provision in the Paragraph (2) of the Article 16 of the Law on Protection of Personal Data No. 6698 is as follows: “Natural and legal persons who process personal data must register with the Data Controllers’ Registry before they start processing data. However, by taking into consideration the objective criteria to be determined by the Board, such as the nature of the personal data processed, the number, the origin of the data processing or the transfer to the third parties, the Board may make an exception to the obligation to register with the Data Controllers’ Registry.” Bearing the following provision in mind as stated in the Paragraph 2 of the Provisional Article 1 of the Law, “Data controllers shall be registered in the Data Controllers’ Registry within the period determined and announced by the Board.”,

it was unanimously decided that

  • the starting date for the registration obligation to be given to the natural and legal person data controllers to register with the Data Controllers’ Registry whose annual headcount is more than 50 or whose total annual financial balance is more than 25 million TL as 01.10.2018, and the deadline for the registration to these data controllers to be given as 30.09.2019,

  • the starting date of the obligation to register with the Data Controllers’ Registry shall be 01.10.2018 and that the data controllers shall be given a deadline until 30.09.2019,

  • the starting date of the obligation to register with the Data Controllers’ Registry shall be 01.01.2019 and the data controllers shall be given a deadline until 31.03.2020 for the natural and legal persons who have less than 50 employees and whose total annual financial balance is less than 25 million TL, in case the main activity of the entity is processing sensitive personal data,

  • the starting date of the obligation to register with the Data Controllers’ Registry for public authorities and institutions shall be 01.04.2019 and the deadline for registration shall be 30.06.2020.

  • this decision to be announced in the website of the Authority and to be published in the Official Gazette.

Decision of the Turkish Personal Data Protection Board dated 03/09/2019 and numbered 2019/265 on the “Extension of the Deadlines for VERBIS Registration”

Date of Decision

: 03/09/2019

Decision No

: 2019/265

Abstract

: Extension of the Deadlines for VERBIS Registration

As a result of the evaluation of the requests conveyed to the Turkish Personal Data Protection Authority by the Union of Chambers and Commodity Exchanges in Turkey (TOBB) and representatives of various sectors regarding the extension of the registration deadlines for the Data Controllers' Registry, it was unanimously decided that

  • the deadline determined for fulfilling the registration obligation to the Registry to be extended until 31.12.2019 for the natural and legal person data controllers with more than 50 employees or a total annual financial balance of more than 25 million TL and natural and legal person data controllers resident abroad,

  • this decision to be announced on the website of the Authority and to be published in the Official Gazette.

Decision of the Turkish Personal Data Protection Board dated 17/12/2019 and numbered 2019/387 on the “Extension of the Deadlines for VERBIS Registration”

Date of Decision

: 17/12/2019

Decision No

: 2019/387

Abstract

: Extension of the Deadlines for VERBIS Registration

According to the decision of the Turkish Personal Data Protection Authority (“KVKK”) dated 17.12.2019 and numbered 2019/387, the deadlines of registration obligation for Data Controllers' Registry Information System ("VERBIS") has been extended.

With the relevant decision, it has been concluded that,

  • The deadline for fulfilling declaration and notification obligation to Registry for natural and legal person data controllers with an annual number of employees of more than 50 or annual financial balance of more than 25 million TL to be updated as 30.06.2020,

  • The deadline for fulfilling declaration and notification obligation to Registry for natural and legal person data controllers resident abroad to be updated as 30.06.2020,

  • The deadline for fulfilling declaration and notification obligation to Registry for natural and legal person data controllers with an annual number of employees of less than 50 or annual financial balance of less than 25 million TL and whose main activity is sensitive personal data processing to be updated as 30.09.2020,

  • The deadline for fulfilling declaration and notification obligation to Registry for public institutions and organizations to be updated as 31.12.2020.

and this decision to be announced at the website of the Authority and to be published in the Official Gazette.

Decision of the Turkish Personal Data Protection Board dated 23/06/2020 and numbered 2020/482 on the “Extension of the Deadlines for VERBIS Registration”

Date of Decision

: 23/06/2020

Decision No

: 2020/482

Abstract

: Extension of the Deadlines for VERBIS Registration

Due to Covid-19 pandemic, which has an effect in our country as in the whole world, some workplaces are physically closed or a remote /alternate working model is applied, on the grounds that it is not possible to prepare personal data processing inventory for the data controllers, and the controllers could not fulfil the obligation to register with the Data Controllers Registry in due time, as a result of the evaluation of the requests conveyed by Turkish Union of Chambers and Commodity Exchanges (TOBB) and various industry representatives to the Authority for the extension of periods regarding the registration with VERBIS, with the decision of the Turkish Personal Data Protection Board dated 23.06.2020 and numbered 2020/482; it has been decided unanimously that;

  • For the natural and legal person data controllers and the natural and legal person data controllers abroad, whose annual number of employees is more than 50 or the annual financial balance sheet total more than 25 million TL, the deadline to fulfil obligation to register with the Registry has been extended to 30.09.2020,
  • For the natural and legal person data controllers whose main field of activity is processing of sensitive personal data and whose annual number of employees is less than 50 or the annual financial balance sheet total less than 25 million TL, the deadline to fulfil obligation to register in the Registry has been extended to 31.03.2021,
  • For the public institutions and organizations, the deadline to fulfil obligation to register in the Registry has been extended to 31.03.2021,
  • The announcement of the mentioned decision to be published on the website of the Authority and in the Official Gazette.

Respectfully announced to the public.