Two-Minute Recap Data Protection Law Matters In Türkiye

Turkey: New Exemption Introduced for VERBIS Registration Obligations

On 4 September 2025, the Turkish Personal Data Protection Board (“the Board”) adopted a landmark decision (No. 2025/1572) introducing a new exemption from the obligation to register with the Data Controllers' Registry (“VERBIS”) under Article 16 of the Personal Data Protection Law numbered 6698 (“PDPL”).

Under the PDPL, all controllers that process personal data are generally required to register with VERBIS unless an exemption is granted by the Board based on objective criteria such as the nature and volume of data processed, the legal basis of processing, or data transfers to third parties. Previous Board decisions, including Decision No. 2018/87 (later amended by Decision No. 2023/1154), exempted controllers with fewer than 50 employees and an annual financial balance sheet below TRY 100 million, provided that their main activity did not involve the processing of special categories of personal