Amendment To The Criteria For The Obligation To Register With The Data Controllers’ Registry

AMENDMENT TO THE CRITERIA FOR THE OBLIGATION TO REGISTER WITH THE DATA CONTROLLERS’ REGISTRY

The exemption criteria for the obligation to register with the Data Controllers’ Registry (“VERBİS”), which had originally been set out in the Personal Data Protection Board (the “Board”) Decision dated 19.07.2018 and numbered 2018/87 and subsequently amended by the Board’s Decision dated 06.07.2023 and numbered 2023/1154, has been further amended by the Board’s Decision dated 04.09.2025 and numbered 2025/1572. This amendment was published in the Official Gazette on 01.10.2025.

Pursuant to this new Decision, the exemption criteria for registration with VERBİS, which had been based on “annual number of employees” and “annual financial balance sheet total”, have been revised in consideration of whether the main field of activity involves the processing of sensitive personal data.

Before the Change	After the Change
Natural or legal person data controllers, whose annual number of employees is less than 50 and annual financial balance sheet total is less than 100 million Turkish lira, whose main field of activity is not processing sensitive personal data	Natural or legal person data controllers, whose annual number of employees is less than 50 and annual financial balance sheet total is less than 100 million Turkish lira, whose main field of activity is not processing sensitive personal data, as well as natural or legal person data controllers, whose main field of activity is processing sensitive personal data but whose annual number of employees is less than 10 and annual financial balance sheet total is less than 10 million Turkish lira

Before the Change

After the Change

Natural or legal person data controllers, whose annual number of employees is less than 50 and annual financial balance sheet total is less than 100 million Turkish lira, whose main field of activity is not processing sensitive personal data, as well as natural or legal person data controllers, whose main field of activity is processing sensitive personal data but whose annual number of employees is less than 10 and annual financial balance sheet total is less than 10 million Turkish lira

The decision entered into force as of the date of its publication in the Official Gazette.

Please let us know if you have any queries.