Who Must Register with VERBİS? An Updated Guide for 2026
One of the most frequently asked questions by companies under the KVKK is: “Who must register with VERBİS?” This question becomes especially important after corporate tax returns have been…
“`html
⏱️ Reading time: 11 min · 📁 Category: KVKK, Digital Compliance and Data Security
Who Must Register with VERBİS? An Updated Guide for 2026
One of the most frequently asked questions by companies under the KVKK is:
“Who must register with VERBİS?”
This question becomes especially important after corporate tax returns have been filed.
Some companies, despite having few employees, may fall within the registration requirement because of their balance sheet total and thus
be required to register with VERBİS.
As of 2026, it is not enough to only look at the number of employees in the VERBIS assessment.
The annual employee count, annual balance sheet total, main activity, processing of special categories of personal data
and whether the controller is established in Türkiye or abroad must be assessed together.
As a general rule, controllers established in Türkiye with
more than 50 employees annually or
an annual balance sheet total of TRY 100 million or more
should be assessed for the VERBİS registration requirement.
Lower thresholds may apply to controllers whose main activity involves processing special categories of personal data.
What is VERBİS?
VERBİS, the Data Controllers Registry Information System, is the registration system through which controllers declare their personal data processing activities
to the Authority.
Through it, controllers declare which personal data categories they process,
the purposes, recipients and retention periods.
- Personal data categories
- Processing purposes
- Recipient groups
- Retention periods
- Domestic and international transfer information
- Technical and administrative measures
VERBIS is not just "registering in the system".
An accurate VERBİS registration requires prior assessment of the data processing inventory,
retention and disposal policy, privacy notices and
data transfer processes together.
The 2026 assessment calls for particular examination of these controllers:
- Natural or legal person controllers with more than 50 employees annually
- Companies with an annual balance sheet total of TRY 100 million or more
- Controllers established abroad
- Controllers whose main activity is processing special categories of personal data
- Public institutions and bodies and professional organisations with public institution status
In the general assessment, the criteria of 50 employees and a TRY 100 million balance sheet total do not both have to be met.
Exceeding either criterion calls for a separate assessment of the VERBİS registration requirement.
The most common error in the VERBIS registration obligation is to look at the number of employees only.
The balance sheet total also directly affects the requirement.
- Number of employees: 32
- Annual balance sheet total: TRY 145 million
Even with fewer than 50 employees, the balance sheet criterion
may trigger a VERBİS registration requirement.
- Number of employees: 78
- Annual balance sheet total: TRY 40 million
In this case, even if the financial balance sheet is low, a registration obligation may arise due to the number of employees criterion.
Example 3: both criteria below the thresholds- Number of employees: 18
- Annual balance sheet total: TRY 35 million
If the main activity is not processing special categories of personal data and no other special circumstances apply,
the company may qualify for an exemption.
Where activities involve extensive processing of special categories of data, such as health, biometric or genetic data, trade union membership, criminal convictions and security measures,
the VERBİS assessment is more sensitive.
For controllers whose main activity is processing special categories of personal data,
employee and balance sheet criteria may be assessed differently from those for ordinary companies.
- Health organizations
- Private clinics and outpatient clinics
- Laboratories
- Special education and counselling centres
- Businesses that use biometric data
- Digital platforms processing large volumes of health data
Not every data controller has to register with VERBIS.
Board decisions may exempt certain controllers or activities from registration.
However, the key point is:
The exception assessment is not automatic.
Assess the activity type, processing volume, whether special categories of data are processed and financial criteria together.
- Certain controllers below the annual employee and balance sheet thresholds
- Small businesses whose main activity is not processing special categories of personal data
- Certain activities classified as exempt by the Board
- Some professional groups whose professional activities are conducted in limited scope
The "we are small businesses, no VERBIS" approach is not always correct.
Always check balance sheet size, processing of special categories of data and digital data volume separately.
The registration deadline is another crucial issue for VERBİS.
Controllers whose registration requirement arises later must, from the date they become subject to it,
complete registration and notification within the prescribed period.
Especially where the balance sheet total becomes clear after the corporate tax return,
carefully monitor the 30-day period for the VERBİS requirement.
For companies whose financial balance sheet total exceeds the threshold after the 2025 corporate tax return,
The VERBIS registration obligation and the 30-day period must also be assessed.
Therefore, the April-May period is a critical period in terms of VERBIS control.
The company's personal data processing structure must be clarified before VERBIS registration is made.
An incomplete or incorrect declaration is more than a technical error: it can create a KVKK compliance risk.
- Data processing inventory
- Personal data categories
- Processing purposes
- Recipient groups
- Retention periods
- Privacy notices
- Retention and disposal policy
- Technical and administrative measures
Yes. Failure to meet VERBİS registration and notification obligations
may lead to an administrative fine under KVKK.
Missing registration is not the only risk: incomplete, inaccurate or outdated notifications may also create risks.
VERBİS registration must match the company’s actual data processing activities.
- The annual number of employees must be checked
- Review the balance sheet total
- Determine whether special categories of personal data are processed
- Data inventory must be updated
- Document the VERBİS registration requirement in writing
The VERBİS registration requirement cannot be assessed simply by employee count alone.
In 2026, companies need to assess the criteria of 50 employees, a TRY 100 million balance sheet total,
processing special categories of personal data and the 30-day registration period together.
Regular VERBİS analysis is particularly important for rapidly growing companies, e-commerce businesses, healthcare businesses,
dealer/franchise networks and organisations processing large amounts of customer data.
B10 Digital Agency provides end-to-end support for VERBİS obligation analysis, data inventories,
VERA work, retention and disposal policies, privacy notices and digital KVKK compliance
processes for organisations.
Thanks to our hybrid model, where legal advisors and technical teams work together,
we aim for sustainable, auditable KVKK compliance alongside registration.
We examine employee count, balance sheet total, activity and data processing structure. 📋 Data inventory
We prepare data categories, purposes and retention periods underlying the VERBİS declaration. ⚖️ KVKK Compliance Plan
We prepare privacy notices, retention and disposal policies and technical/administrative measures.
An obligation analysis is needed to determine whether your company must register with VERBİS.
Get VERBİS and KVKK compliance advice
Generally, controllers with more than 50 employees annually or an annual balance sheet total of TRY 100 million or more should be assessed for the VERBİS requirement.
Can companies with fewer than 50 employees need to register?Yes. Even with fewer than 50 employees, a balance sheet total exceeding the relevant threshold may trigger the VERBİS registration requirement.
When does the 30-day registration period start?Registration and notification must be completed within the prescribed period from the date the obligation arises. The balance sheet criterion following the corporate tax return is important here.
Is there a penalty for not registering with VERBİS?Yes. Failure to meet VERBİS registration and notification obligations may lead to an administrative fine under KVKK.
Sources and related documents
These documents provide references for the methods and rules discussed in this article.