VERBİS Registration Obligation Checklist

CHECKLIST · 30 ITEMS · 25 MIN

VERBİS Registration Obligation Checklist

A 30-item VERBİS registration preparation checklist for companies operating in Turkey — from threshold determination through post-registration compliance. 2026 penalty band TRY 341,809 – 17,092,242.

Unlock the checklist

Enter your email and join the Vircon Substack list to access this checklist. Your entries are stored only in your browser.

Join the Vircon Substack list to receive new content.

0 / 30 Saved

SECTION 1 8 ITEMSThreshold Determination SECTION 2 8 ITEMSRegistration Preparation SECTION 3 8 ITEMSNotification Preparation SECTION 4 6 ITEMSPost-Registration Compliance

SECTION 1 · 8 ITEMS

Threshold Determination

Identify whether you fall within the registration perimeter. Wrong assumption here is the costliest mistake — VERBİS penalties for 2026 reach TRY 17,092,242.

01Data controller or data processor classificationDetermine whether your company sets the purpose and means of processing (controller) or processes on behalf of another (processor). Only controllers register with VERBİS. (KVKK Art. 3)

02Annual employee count above 50Use the average number of employees over the year, including R&D and part-time staff. Threshold is one of two triggers.

03Annual financial balance above TRY 100MBalance-sheet method taxpayers: use total assets or liabilities from corporate tax declaration. If above TRY 100M, registration is mandatory regardless of headcount.

04Core business processes special-category dataHealth, biometric, genetic, religious, political, race, criminal record, trade-union data. If core business involves these, separate thresholds apply.

05Bookkeeping method confirmedBalance-sheet method requires both employee and balance criteria; business-account method only employee criterion applies. (Council Decision 2025/1572)

06Foreign-resident data controllers — representative appointmentNon-Turkey-resident controllers processing Turkish residents’ data must appoint a Turkey-based representative before VERBİS registration. (KVKK Art. 11)

07Sector-based exemption check (notary, attorney)Notaries (Law No. 1512) and attorneys (Law No. 1136) are exempt from VERBİS. Other professions check Council bulletins for sector exemptions.

082025/1572 Council Decision new exemptionEven if core business is special-category data: if employee count under 10 AND balance under TRY 10M, you are exempt. New small-controller carveout. (Council Decision 04.09.2025/1572)

SECTION 2 · 8 ITEMS

Registration Preparation

Documentation and accounts you need before opening the VERBİS portal — preparation cuts registration time from weeks to days.

09Contact person designated (single-firm rule)Turkey-resident controllers: one person can represent only one controller. Foreign-resident controllers can share contact persons across multiple entities. (Council Decision 16.07.2020/2020-542)

10Tax ID and MERSİS number verifiedTax number from Revenue Administration, MERSİS number from Trade Registry. Both required at application; mismatches block portal access.

11Qualified e-signature or KEP address readyApplication form must be signed with qualified electronic signature (NES) or filed via registered electronic mail (KEP). No alternative for online applications.

12Founding documents and authority circulars readyTrade Registry Gazette extract, signature circular, and articles of association — required when authority is challenged or representative changes.

13Application form completeCompany information, contact details, contact person details, representative information (if foreign-resident). Incomplete forms returned within 7 days.

14Signature authority scope documentedSignature circular must clearly authorize VERBİS application. Authority limits checked against board resolution; mismatches delay registration.

15Employee count documentationSGK declaration showing year-average employee count. Documents covering January-to-December headcount progression.

16Financial balance summary documentLast filed corporate tax declaration balance sheet, or business-account income/expense ledger summary. KGK threshold check defaults to last full fiscal year.

SECTION 3 · 8 ITEMS

Notification Preparation

Substantive data that will populate the public VERBİS record. Quality of this section determines public-facing compliance signaling.

17Personal data inventory completeSystematic listing of every personal-data flow: source, collection method, system stored in, processing reason, sharing partners. Living document, refreshed annually.

18Data categories definedIdentity, contact, location, financial, customer transaction, audio-visual, employee record, special-category data. Each category mapped to processing activities.

19Data subject groups identifiedCustomers, employees, suppliers, visitors, website users, prospects, candidates. Each group’s data processing legal basis documented separately.

20Processing purposes documentedSpecific, explicit purposes per category: contract performance, legal obligation, legitimate interest, consent, vital interests, public interest. (KVKK Art. 5)

21Recipient parties listedThird parties receiving personal data: service providers, cloud platforms, government agencies, professional advisors. Each recipient’s legal basis for transfer recorded.

22Cross-border transfer mechanism declaredAdequacy decision country, written undertaking + Board approval, explicit consent, or one of Art. 9 narrow derogations. Mechanism per transfer route. (KVKK Art. 9 amended 2024)

23Retention periods setEach data category’s retention period justified — by law (mandatory minimums), contract performance, or legitimate-interest assessment. Inventory matrix maintained.

24Technical and organizational measures documentedEncryption, access control, audit logs, backup, vendor due diligence, employee training, incident response. Annual measure review. (KVKK Art. 12)

SECTION 4 · 6 ITEMS

Post-Registration Compliance

Registration is the starting line, not the finish. Ongoing obligations that determine whether the registration genuinely shields you from enforcement.

25Privacy notice published and accessibleBilingual privacy notices on website, app, and at data collection points. KVKK Communiqué on Procedures and Principles of Privacy Notice followed. (KVKK Art. 10)

26Explicit consent flows where legally requiredWhere consent is the lawful basis, design granular, withdrawable, freely-given consent UI. Pre-ticked boxes and bundled consents are non-compliant.

27Data subject request procedure operationalInternal SLA for 30-day response to access, correction, deletion, objection requests. (Communiqué on Procedures and Principles for Application to Data Controller)

28Breach notification process in placeNotify the Board within 72 hours; notify affected data subjects in the shortest time possible. Pre-written templates and escalation chain reduce risk.

29VERBİS update process (7-day rule)Any change in registration information — contact person, threshold status, processing activities — must be updated within 7 days. Calendar reminders recommended.

30Annual review and KVKK awareness trainingAnnual compliance audit covering registration accuracy and inventory currency. Staff KVKK training documented — Board enforcement cites training failures.

Decision Matrix — Are We VERBİS-Ready?

How your checked items distribute shows how ready you are for VERBİS process:

Section 1 8/8: Obligation accurately determined. No wrong-assumption risk.
Section 2 6+/8: Application ready. You can access the portal within 30 days.
Section 3 6+/8: Notification can be filed completely. Strong public-facing compliance signal.
Section 4 4+/6: Post-registration compliance solid. Audit-ready.
All four sections above threshold: Your VERBİS compliance is in order — enter the portal now.
Section 1 weak: Determine obligation first. Wrong assumption exposes you to VERBİS-absent-operation penalty.
Section 3 weak: Data inventory and mapping are critical. Without these, registration does not deliver real protection.
Section 4 weak: Registration alone is not enough — KVKK Board sanctions frequently penalize post-registration neglect.

Legal notice. This document is for informational purposes only and does not constitute legal advice. The KVKK provisions, Council decisions and communiqués referenced are general references; applying them to your company requires evaluation by a lawyer. For a company-specific assessment, contact Vircon Legal: [email protected]

Detailed version

If you haven’t read “VERBİS Registration Process” — start there.

Read the Article

SISTER CHECKLISTS

Book a free 30-minute intro call

Once you've worked through this checklist, pick a time below for a personalized risk review and prioritization of any remaining items.

VERBİS Registration Obligation Checklist

Unlock the checklist

Threshold Determination

Registration Preparation

Notification Preparation

Post-Registration Compliance

Decision Matrix — Are We VERBİS-Ready?

Detailed version

You may also like

Book a free 30-minute intro call