What is VERBİS?
VERBİS (Veri Sorumluları Sicil Bilgi Sistemi) is the public Data Controllers’ Registry Information System maintained by Türkiye’s Personal Data Protection Authority under KVKK Article 16. A data controller within scope must register before it starts processing personal data and declare, category by category, what it processes, for which purposes, for how long it retains the data, and to whom it transfers it — effectively a public summary of the company’s processing inventory. The declaration should mirror the internal records of processing; the registry entry is that inventory’s public face.
Who must register
- Companies above the Board’s thresholds — currently 50+ employees or TRY 100M+ annual turnover;
- All controllers whose main activity is processing special-category data, regardless of size;
- Non-resident controllers processing data of persons in Türkiye must register regardless of size and appoint a local representative — the trap for foreign SaaS;
- Registration is a controller duty: a data processor acting purely on instructions does not register for that processing.
The legal dimension
Registration is a precondition of lawful processing for entities in scope, and entries must be kept current: changes are notified within 30 days. Failure to register or update carries administrative fines under KVKK, and the KVKK Authority can act on complaint or on its own motion. Because the registry is public, mismatch between VERBİS and reality is verifiable in minutes — which is why VERBİS gaps are the easiest finding in any KVKK inspection.
Why it matters in practice
VERBİS is a standing item in M&A and investment due diligence: the buyer compares the target’s registry entry with its actual data flows, and discrepancies surface as warranty and indemnity points. For foreign companies, the non-resident rule means a SaaS product with users in Türkiye can owe registration with no Turkish entity at all. The pragmatic sequence is inventory first, registry second — a filing not grounded in a real inventory produces exactly the mismatch the registry makes visible.
Do: check your thresholds, build the inventory, register before processing, and diarise the 30-day update duty. Don’t: copy a template filing or let the entry drift from practice — the registry is public and the comparison takes minutes.
Sources. Law No. 6698 on the Protection of Personal Data (KVKK). Statute links open the official consolidated Turkish texts on mevzuat.gov.tr.