VERBİS is the Data Controllers Registry kept by Turkey’s Personal Data Protection Authority. It is public and shows what categories of personal data a registered controller processes, why, and which security measures it applies.
Registration is the rule, but the Board exempts some controllers based on employee numbers, annual balance sheet totals and main activity, as well as certain professions and organisations under conditions. Controllers whose main activity is processing special category data, and foreign controllers, are generally required to register. Thresholds change, so check current criteria.
- Check exemption status and document it.
- Prepare the personal data inventory and a retention and destruction policy.
- Appoint a contact person.
- Log in to the official system, create the application and enter purposes, data subject groups, data categories, recipients, transfers abroad, retention periods and security measures.
- Keep the record updated when anything changes.
Exemption from VERBİS is not exemption from KVKK. This is general information; confirm with your advisers. Racurity helps make declared technical measures real.
Talk to Racoun: we are based in Istanbul and work with brands across Türkiye. Message us on WhatsApp or email ekip@racoun.com.
