How to Register with VERBİS: The Application Process Step by Step
VERBİS registration is the process by which controllers required to register under KVKK declare their personal data processing activities through the Data Controllers Registry Information System.
⏱️ Reading time: 11 min · 📁 Category: KVKK, Digital Compliance and Data Security
How to Register with VERBİS: The Application Process Step by Step
VERBİS registration is the process by which controllers required to register under KVKK declare their personal data processing activities through the
Data Controllers Registry Information System.
However, VERBİS registration involves more than logging into the system and filling in forms.
For a correct VERBİS application, the company’s data processing inventory must first be prepared, and
data categories, processing purposes, recipient groups, retention periods and technical/administrative measures must be clarified.
VERBİS registration comprises obligation analysis, data inventory preparation, application user registration, entry of registry information,
declaration of data categories and confirmation of registration.
The company's personal data processing structure must be clarified before registering with VERBIS.
Information entered without preparation may be incomplete, inaccurate, or incompatible with the company's actual data processing activities.
- Data processing inventory
- Personal data categories
- Processing purposes
- Recipients and recipient groups
- Storage periods
- Domestic and international transfer information
- Technical and administrative measures
- Privacy notices
- Retention and disposal policy
The most common VERBİS registration mistake is completing the registration screens before preparing the inventory.
In this case, the declared information may not match the company’s actual data processing operations.
The first step is to determine whether the company really has to register with VERBIS.
Assess employee count, balance sheet total, main activity and processing of special categories of personal data together.
- More than 50 employees per year?
- Does the annual balance sheet total exceed the relevant threshold?
- Is the main activity processing special categories of personal data?
- Is the controller established abroad?
- Does a special situation fall within the Board’s exemptions?
The basis of the VERBIS record is data processing inventory.
Inventory is the main document that shows which personal data the company processes for what purposes.
At this stage, review HR, accounting, sales, marketing, e-commerce, customer service, IT and legal processes separately.
3️⃣ Create an application user in the VERBİS system
The person acting on behalf of the controller is designated as the application user in the system.
This authorized user handles the VERBİS application on behalf of the company.
When creating the application user, enter company, contact and authorized person details correctly.
4️⃣ Enter the controller’s informationAt this stage, enter the controller’s basic details into the system.
- Company name
- Tax identification number
- Address
- Contact details
- Business activity
- Authorized person’s details
The personal data categories that the company processes are declared in the VERBIS system.
These categories must be compatible with the data processing inventory.
- Identification information
- Contact details
- Finance information
- Personnel information
- Customer transaction information
- Transaction security information
- Visual and audio recordings
- special categories of personal data
If the company actually processes special categories of personal data, this must be correctly reflected in its VERBİS declaration.
Categories such as health, biometric or criminal conviction data must not be declared inaccurately or incompletely.
The purposes for processing personal data and the recipients of transfers are among the most important parts of VERBİS registration.
- Conducting employee processes
- Managing customer relationships
- Conducting contract processes
- Finance and accounting transactions
- Marketing activities
- Information security processes
- Notification to competent public institutions
The VERBIS record should also state how long personal data is stored.
Retention periods must not be chosen arbitrarily; assess legislation, contractual relationships, limitation periods and company policies together.
Define procedures for deleting, destroying or anonymizing personal data whose retention period has expired.
8️⃣ Select technical and administrative measures
Technical and administrative measures for data security are also declared in the VERBIS record.
Complete this section to reflect the company’s actual level of security.
- Access authorization
- Logs
- Encryption
- Authorization matrix
- Backup policies
- Employee confidentiality commitments
- KVKK awareness trainings
- Penetration testing and security audits
Once all information is entered, registration is approved.
However, once the VERBIS registration is complete, the process is not over.
The VERBIS record must also be updated when there is a change in the company's data processing activities.
A new CRM system, transfers abroad, new marketing channels or beginning to process special categories of data may require an update to VERBİS registration.
Common VERBİS registration mistakes- Registering before preparing a data inventory
- Incomplete declaration of data categories
- Overlooking special categories of personal data
- Random determination of retention times
- Incomplete recipient groups
- Incorrectly describing international transfer procedures
- Inconsistency between VERBİS registration and privacy notices
The time required for VERBİS registration depends on the company’s data processing structure.
Preparation may take less time for companies with small, simple data processing operations;
the process must be more comprehensive for companies with multiple branches, e-commerce operations or large volumes of employee and customer data.
- Companies in simple structure: a few days
- Medium-sized companies: 1-2 weeks
- Companies with multiple branches or departments: 2–4 weeks
- Companies with incomplete inventories: longer preparation
After the VERBIS registration is completed, the company's KVKK compliance process continues.
Registration alone does not mean full compliance.
- Update privacy notices
- Check explicit consent procedures
- The retention and disposal policy must be implemented
- Provide KVKK training for employees
- Review contracts with data processors
- Cookie and digital tracking technologies should also be evaluated
The VERBIS record is only part of the KVKK compliance process.
For correct registration, first analyze the company’s personal data processing activities, then prepare a VERBİS declaration that reflects those actual activities.
A faulty or incomplete VERBIS record can lead to serious compliance problems in future audits and complaint processes.
VERBİS registration should therefore be regarded not as a technical data entry task, but as a legal, administrative and technical compliance effort.
At B10 Digital Agency, we support organizations with VERBİS obligation analysis, data inventory preparation,
the VERBİS registration process, retention and disposal policies, privacy notices and digital KVKK compliance.
Thanks to our hybrid model, where legal advisors and technical teams work together,
we aim for both VERBİS registration and a sustainable, auditable KVKK compliance framework.
Your company's requirement to register with VERBIS is clarified. 📋 Inventory & VERA
Data categories, processing purposes and retention times are prepared. ⚖️ KVKK Compliance Plan
We organize privacy notices, disposal procedures, data processor arrangements and technical/administrative measures.
A pre-registration analysis is recommended so that your VERBİS registration reflects your company’s actual data processing activities.
Get advice on VERBİS registration and KVKK compliance
First, the data processing inventory is prepared, then the data controller information, data categories, processing purposes, retention times and measures are declared in the VERBIS system.
Is data inventory mandatory for VERBIS registration?A data inventory must be prepared for a sound VERBİS registration. Registration without one may be incomplete or inaccurate.
How long does VERBİS registration take?It depends on the size of the company and its data processing structure. It can take several days in simple structures, several weeks in more complex structures.
Do I need to update after I have registered?Yes. VERBİS registration must also be updated when data processing activities change.
Sources and related documents
These documents provide references for the methods and rules discussed in this article.