What Is VERBİS? An Updated Guide for Companies in 2026

VERBİS is the registration mechanism through which data controllers report information about their personal data processing activities to the Registry using the Data Controllers Registry Information System. It is not a repository for uploading individual personal data records or lists of people to the Authority.

Company size alone is not enough to assess VERBİS obligations in 2026. Annual employee numbers, the balance sheet, the main business activity, processing of special categories of personal data and any specific exemptions applicable to the controller must be assessed together.

What Information Is Included in the Verbis Notice?

According to the Authority, the notification includes the identity and address of the controller and its representative, if any; processing purposes; data-subject groups and data categories; recipients or recipient groups; personal data intended for transfer abroad; data-security measures; and maximum retention periods.

VERBİS registration should therefore not be treated as a purely administrative form that can be prepared independently of actual processing activities.

2026 General Exception Criteria

For controllers whose main activity is not processing special categories of personal data, Board Decision 2023/1154 updated the balance-sheet criterion to TRY 100 million.

For controllers keeping accounts on a balance-sheet basis, the exemption criteria are assessed jointly: fewer than 50 employees annually and an annual balance-sheet total below TRY 100 million.

What changed when processing special categories of data is the main activity?

Board Decision 2025/1572 of 4 September 2025 also exempted natural-person or legal-person controllers whose main activity is processing special categories of personal data, provided they have fewer than 10 employees annually and an annual balance-sheet total below TRY 10 million.

This change needs particular assessment for small controllers in healthcare and similar fields where processing special categories of data is the main activity.

Criteria when accounts are not kept on a balance-sheet basis

Board Decision 2025/2393 of 25 December 2025 clarified that only the annual employee-number criterion applies to controllers not keeping accounts on a balance-sheet basis, because no annual balance-sheet total is available.

Do not assess VERBİS obligations solely from turnover or the everyday use of the word “balance sheet”; also confirm the accounting basis used by the company.

Post-Record Update

VERBİS is not a static register to complete once and forget. When data categories, purposes, recipient groups, international transfer arrangements or retention periods change, check that the notification still matches actual processes.

A new SaaS service, CRM migration, AI system, employee application or foreign cloud service can change data flows.

2026 VERBIS Checklist

Has the number of employees per year been correctly calculated?
Has the company’s accounting basis, with or without a balance sheet, been confirmed?
Is processing special categories of personal data the main activity?
Can one of the exception criteria really be applied?
Is the data inventory up to date?
Are data transfers abroad being shown correctly?
Do maximum retention periods match actual systems?
Is the VERBIS notification updated after changes?

Manage VERBİS as an ongoing control, not a static registration

VERBİS and the personal data inventory can quickly become outdated when disconnected from actual company operations. A new employee application, CRM, payment infrastructure, web form, marketing tool, SaaS service, cloud provider or AI application can introduce new data categories, recipient groups or international transfers. Procurement, software development, integration and supplier onboarding processes therefore need checks on their personal data implications.

In a sound control model, each processing activity is linked to a business process owner, a system owner and a legal assessment. Recording the source and destination systems, data-subject group, data category, purpose, legal basis, recipient, transfer country or arrangement, retention period and security measures together allows VERBİS notifications to reflect actual operations. The registry entry then becomes more than a document opened only for audits.

Periodic reviews should cover discontinued processes as well as new ones. Unused applications, old user accounts, archives, logs, backups and terminated supplier connections can create data-retention and access risks. Cross-checking the inventory against technical systems in both directions helps prevent both incomplete notifications and obsolete processing activities remaining unnecessarily in the Registry.

B10 Digital Agency’s approach to KVKK and digital compliance

B10 Digital Agency treats KVKK work as more than document preparation: it is an operational compliance model combining the data inventory, VERBİS, system and integration mapping, international data transfers, security controls and change management.

Frequently Asked Questions

Is personal data itself uploaded to VERBIS?

No. The Registry receives category and process information about data processing activities.

Is every company with less than 50 employees exempt from VERBIS?

No. The balance sheet, main activity, processing of special categories of data and other criteria must be assessed together.

Is there an exemption for small businesses processing special categories of data?

Decision 2025/1572 introduced an exemption for controllers whose main activity is processing special categories of data and who meet specific employee-number and balance-sheet conditions.

Are updates needed after VERBİS registration?

Yes. When the processing activities underlying the notification change, check that the Registry entry remains up to date.

Related VERBIS Guidelines

Official Sources

Note: This content provides general information. A company’s specific VERBİS and KVKK obligations require a separate assessment of its activities and current legislation.

Align your VERBİS registration with your actual data flows

Explore B10 Digital Agency’s KVKK & Digital Compliance service to assess your data inventory, VERBİS, international transfers and digital systems together.

Explore KVKK & Digital Compliance Consulting →