How to Match a VERBİS Inventory to Actual Data Flows

A mismatch between a VERBİS notification and a company’s actual data flows is a common operational problem in KVKK projects. An inventory may have been prepared years ago, while new CRM or SaaS systems, mobile applications, cloud services or AI tools have since been introduced.

Updating the existing Excel inventory is not enough. Remap the technical flow: where data is collected, where it is processed, which integrations transfer it, where it is retained and when it is deleted.

Where should data-flow mapping begin?

Start by listing business units and systems. Processes in HR, customer service, sales, e-commerce, marketing, accounting and IT can be considered separately.

For each process, identify the data source, data-subject group, application used, transfer destination and storage location.

Create a system inventory

ERP
CRM
Email
HR system
E-commerce infrastructure
Mobile application
Web analytics
Cloud storage
SaaS applications
AI and automation systems

Examine Integrations Separately

Data held in one system may be transferred to another through an API, webhook, ETL process or manual export. An inventory listing only the main application can leave this transfer invisible.

In particular, map CRM–ERP, web–CRM, marketplace–ERP and AI–data source connections as separate data flows.

Mapping to VERBİS fields

Map the data-subject groups, data categories, processing purposes, recipient groups, international transfers, security measures and maximum retention periods listed by the Authority to their counterparts in actual system flows.

Being able to trace each VERBİS entry to the business process and systems behind it makes updates easier.

Check international data flows at the technical level

Even when a SaaS provider is headquartered in Türkiye, its infrastructure, subprocessors and data-storage locations may require a separate review.

Review cloud, analytics, customer support, email and AI services individually for these issues.

Verify retention periods against actual systems

Writing “10 years” or “for the duration of employment” in the inventory is not enough. Check actual retention behaviour in databases, file servers, backups, CRM and logging systems.

If deletion or anonymisation cannot be implemented technically, the inventory does not match the actual system.

Establish change management

Checking data flows for KVKK compliance before introducing new software, an API integration, a data field, a supplier or an AI project prevents the inventory from becoming outdated again.

A simple change-notification process can connect IT, legal/KVKK teams and business units.

Mapping matrix

Business process
Data-subject group
Data category
Processing purpose
Legal basis
Source system
Destination system
Recipient group
International data transfer
Retention period
Security measure
Corresponding VERBİS field

Manage VERBİS as an ongoing control, not a static registration

VERBİS and the personal data inventory can quickly become outdated when disconnected from actual company operations. A new employee application, CRM, payment infrastructure, web form, marketing tool, SaaS service, cloud provider or AI application can introduce new data categories, recipient groups or international transfers. Procurement, software development, integration and supplier onboarding processes therefore need checks on their personal data implications.

In a sound control model, each processing activity is linked to a business process owner, a system owner and a legal assessment. Recording the source and destination systems, data-subject group, data category, purpose, legal basis, recipient, transfer country or arrangement, retention period and security measures together allows VERBİS notifications to reflect actual operations. The registry entry then becomes more than a document opened only for audits.

Periodic reviews should cover discontinued processes as well as new ones. Unused applications, old user accounts, archives, logs, backups and terminated supplier connections can create data-retention and access risks. Cross-checking the inventory against technical systems in both directions helps prevent both incomplete notifications and obsolete processing activities remaining unnecessarily in the Registry.

B10 Digital Agency’s approach to KVKK and digital compliance

B10 Digital Agency treats KVKK work as more than document preparation: it is an operational compliance model combining the data inventory, VERBİS, system and integration mapping, international data transfers, security controls and change management.

Frequently Asked Questions

Can a VERBİS inventory be maintained solely in Excel?

Keeping it current matters more than the tool, but it must have a traceable link to actual systems and data flows.

Can the new SaaS product affect VERBIS?

Yes. A new SaaS product can change data categories, recipients, international transfers or the security setup.

Should backup data also be considered when setting retention periods?

Assess backup environments as well when designing actual retention and destruction processes.

When should the inventory be updated?

Review the inventory when significant changes occur, such as new systems, integrations, suppliers or processing purposes.

Related VERBIS Guidelines

Official Sources

Note: This content provides general information. A company’s specific VERBİS and KVKK obligations require a separate assessment of its activities and current legislation.

Align your VERBİS registration with your actual data flows

Explore B10 Digital Agency’s KVKK & Digital Compliance service to assess your data inventory, VERBİS, international transfers and digital systems together.

Explore KVKK & Digital Compliance Consulting →