Registering with VERBİS: Turkey's Data Controller Guide

If your business collects, stores, or uses personal data in Turkey — whether you are a startup in Antalya, a foreign-owned company with a Turkish branch, or an e-commerce operation reaching Turkish customers — you may be required to register with VERBİS before you process a single record. Skipping this step is not a technicality; it is the kind of oversight that can trigger an administrative fine of up to one million Turkish lira under Turkey's Personal Data Protection Law (KVKK, Kişisel Verilerin Korunması Kanunu).

What Is VERBİS?

VERBİS stands for Veri Sorumluları Sicil Bilgi Sistemi — the Data Controllers Registry Information System. It is an online platform maintained by the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) where data controllers declare who they are, what data they process, why they process it, and how they protect it.

Under Article 16 of the KVKK, this registry is open to the public. Anyone can look up a company to see which categories of personal data it processes, how long it retains them, and whether it transfers them abroad. Transparency is built into the system by design.

Who Needs to Register?

The general rule is clear: any natural or legal person that determines the purposes and means of personal data processing — a "data controller" in KVKK terms — must register with VERBİS before starting to process personal data. This covers Turkish companies, foreign companies with Turkish branches or representatives, and online businesses that systematically target Turkish residents. Sectors ranging from retail and real estate to healthcare and technology all fall within scope.

The KVKK Board has authority to exempt certain data controllers from the registration obligation based on objective criteria: the nature and volume of data processed, the sector of activity, whether data is transferred to third parties, the size of the organisation. Small operators processing limited data categories for purely internal purposes may qualify for an exemption. If you are unsure, the safer approach is to register rather than assume an exemption applies.

Foreign companies without a physical presence in Turkey can also fall within the KVKK's reach if they systematically process the personal data of people in Turkey. Those without a local establishment must appoint a representative in Turkey to handle registry processes on their behalf. Our KVKK compliance overview covers the broader framework these obligations sit within.

What Does the Registration Require?

Article 16 of the KVKK sets out the information that a VERBİS registration must include:

• The identity and address of the data controller; if based outside Turkey, the details of the Turkish representative
• The purposes for which personal data is processed
• The categories of data subjects and the types of data held
• The recipients or categories of recipients to whom data may be transferred
• Whether any data is transferred abroad, and to which countries
• The security measures in place to protect the data
• The maximum retention period for each category of data

Before submitting this information, you must prepare an internal Kişisel Veri İşleme Envanteri (Personal Data Processing Inventory) that maps all your processing activities. The VERBİS filing draws directly from this inventory. Any change to your registered information must be notified through VERBİS within seven days of the change occurring.

Timing: When Must You Register?

The law is strict on this point: data controllers must complete VERBİS registration before they begin processing personal data. If your organisation subsequently becomes subject to the obligation — for example because your operations scale past an exemption threshold — the implementing regulation gives you thirty days from that point to complete the filing.

Many businesses, especially foreign nationals setting up in Turkey, treat this step as something to handle later. That approach creates real risk. The KVKK Board conducts proactive inspections and acts on complaints, and registration failures are among the most straightforward violations to identify.

What Happens If You Do Not Register?

Article 18(1)(ç) of the KVKK is explicit: violating the VERBİS registration and notification obligation can lead to an administrative fine ranging from 20,000 Turkish lira to 1,000,000 Turkish lira. The fine applies to the data controller directly. Following a 2024 amendment to the KVKK, administrative fines imposed by the Board can be challenged in administrative courts.

The fine is not the only consequence. Absence from VERBİS often signals to regulators that KVKK compliance is weak more broadly. A complaint about, say, a failure to respond to an access request can prompt the Board to examine the whole picture — including whether VERBİS registration was in place. Our guide on cross-border data transfer rules explains how related obligations stack up for foreign-controlled entities.

Frequently Asked Questions

Q: Does a foreign company with no office in Turkey need to register with VERBİS?

If a foreign company systematically processes the personal data of people in Turkey — for example, an e-commerce platform with Turkish customers — it generally falls within the scope of the KVKK. Registration must be completed through a Turkish representative, who handles the process on the company's behalf.

Q: Is the registration renewed each year?

There is no annual renewal requirement. However, you must keep your registry entry current at all times. Any change to declared purposes, data categories, security measures, or other registered details must be updated in VERBİS within seven days of the change.

Q: What is the processing inventory, and do I need it even if I am exempt from VERBİS?

The Kişisel Veri İşleme Envanteri is an internal document mapping every personal data processing activity your organisation carries out. It underpins your VERBİS filing and your broader KVKK compliance. Even if the Board exempts you from registration, your other KVKK obligations — data security, data subject rights, retention limits — remain in force, and a processing inventory is the practical foundation for meeting them. For more detail on the consent and transparency obligations that sit alongside VERBİS, see our article on privacy notices and explicit consent under KVKK.

Q: How does the Board set a fine within the 20,000–1,000,000 TL range?

The Board exercises discretion based on factors including the nature and scope of the violation, whether it was intentional, how long it lasted, and the size of the data controller. There is no fixed formula.

How Mona Hukuk Can Help

Mona Hukuk advises businesses in Antalya and across Turkey on KVKK compliance, including VERBİS registration, preparation of data processing inventories, and representation before the Personal Data Protection Authority. We work with Turkish-based companies and foreign-controlled entities that have Turkish operations or process data belonging to Turkish residents.

Contact us at contact@monahukuk.com or call +90 (242) 606 14 32 to schedule a consultation in Antalya.