ARTICLE · 22 AUGUST 2024

Obligation For Data Controllers To Register With The Turkish Registry Of Data Controllers (Verbis)

Ozdirekcan Dundar Senocak Ak Avukatlik Ortakligi

Explore more from Ozdirekcan Dundar Senocak Ak Avukatlik Ortakligi

Pursuant to Article 16 of Law No 6698 on the Protection of Personal Data, data controllers who process personal data by automated means and who meet certain criteria are obliged to register in the Registry of Data Controllers and establish a personal data processing inventory before starting to process data

TurkeyPrivacy

Ecem Nur Aksoy

Pursuant to Article 16 of Law No 6698 on the Protection of Personal Data (the "Law"), data controllers who process personal data by automated means and who meet certain criteria are obliged to register in the Registry of Data Controllers ("VERBIS") and establish a personal data processing inventory before starting to process data. VERBIS is a registration system that collects information on the data processing activities of data controllers in Türkiye.

On 1 August 2024, the Turkish Data Protection Authority (the "DPA") announced the findings resulting from its investigations conducted with respect to compliance of companies to the requirement to register with VERBIS, along with related statistics on administrative fines imposed for non-compliance.¹ This client alert is intended to remind both Turkish and foreign data controllers of the VERBIS registration requirement, the procedures to be followed and the administrative fines imposed for non-compliance.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

Related Articles

Digital Transformation In Packaging: Compliance Deadlines For E-Leaflets, QR Codes, And Anti-Tampering

ELIG Gürkaynak Attorneys-at-Law

Veri Koruma Hukuku Gündemi Eylül 2026

Data Protection Law Updates September 2026

Turkiye Introduces New Age Verification And Child Protection Requirements For Social Network Providers

Balcioglu Selçuk Eymirlioglu Ardiyok Keki Attorney Partnership

Two-Minute Recap Data Protection Law Matters In Türkiye

Gen Temizer Erdogan Girgin Attorney Partnership

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Privacy
- Data Protection

Related Comparative Guides

Comparative Guide

Data Protection & Cybersecurity

See more popular content from

Privacy

Protecting Minors In The Digital Environment

This article examines the protection of minors in digital services through a comparative legal analysis directed at foreign platforms and families. It distinguishes access restrictions, age assurance, parental authority, personal-data processing and routes of challenge.

ONGUR & PARTNERS

Quick Read: Data Protection & Cybersecurity Updates In Türkiye – January 2026

In January 2026, the Turkish Personal Data Protection Authority (the "DPA") issued several public announcements and published six data breach notifications.

The Personal Data Protection Authority Public Announcement On Transferring Personal Data Of Turkish Citizens Residing Abroad

Following numerous filings from Turkish citizens, residing abroad, concerning transfer and sharing of their personal data with institutions and organizations of other countries, the Personal Data Protection Authority ...

Deris Attorney At Law Partnership

Turkey Introduces Age Verification And Child Account Obligations For Social Networks

The Regulation will take effect on 1 November 2026 and allows until 31 March 2027 for existing accounts, and as the relevant sanction provisions of Law No. 5651 will apply to breaches of its obligations, social network providers should review their registration flows, child accounts and objection processes before the effective date.

Not The Final Word: How To Challenge Personal Data Protection Board Decisions In Türkiye

For many businesses in Türkiye, a single decision of the Personal Data Protection Board can now mean multimillion-lira fines, suspended data transfers, and immediate operational disruptions.

KVKK Yurt Dışı Veri Aktarım Rehberi

6698 sayılı Kişisel Verilerin Korunması Kanunu’nun (“KVKK”) 9 uncu maddesi kapsamında kişisel verilerin yurtdışına aktarımlarının uygulanması ile Kişisel Verileri Koruma Kurulu’nun (“Kurul”) beklediği uygun güvenceler hakkında kamuoyunun aydınlatılması amacıyla Kişisel Verileri Koruma Kurumu (“Kurum”) tarafından 2 Ocak 2025 tarihinde Kişisel Verilerin Yurt Dışına Aktarılması Rehberi (“Rehber”) yayımlanmıştır.

Barlas & Karabucak Law Firm

Differences Between The KVKK And The GDPR

Pursuant to Article 3 of the Law No. 6698 on the Protection of Personal Data (“KVKK”), personal data is defined as any information relating to an identified or identifiable natural person. Although the concept is expressed in these terms under Turkish law, different legal systems adopt different approaches.

ADMD/Mavioglu & Alkan Law Office

KVKK Yurt Dışına Veri Aktarımı Rehberi (2026 Güncel Düzenlemeler)

Türkiye'de kişisel verilerin yurt dışına aktarılması süreci, 10 Temmuz 2024'te yayımlanan yönetmelik ve 2026 yılı itibarıyla tam kapasite çalışan dijital bildirim...

ESENYEL & PARTNERS Lawyers and Consultants

Data Protection And Privacy Law In Türkiye Key Developments And Predictions - 2026

This comprehensive report examines the evolving landscape of personal data protection in Türkiye, analyzing regulatory developments, enforcement trends, and emerging compliance challenges through 2025 and into the first half of 2026. The analysis covers the Turkish Personal Data Protection Authority's expanding guidance framework, significant enforcement actions totaling TRY 352.5 million in fines, and critical regulatory shifts including new cybersecurity legislation and constitutional court decisions

Gün + Partners

Cross-Border Transfer Of Personal Data And Key Considerations

Technological developments, the widespread use of cloud-based services, the operation of companies within multinational group structures and the increasing reliance on service providers located abroad have made cross-border transfers of personal data an integral part of companies’ day-to-day business activities.

Sakar Law Office