VERBIS is the acronym of Turkey's Data Controllers' Registry Information System: a public register maintained by the Turkish Personal Data Protection Authority, in which data controllers must register under Article 16 of the KVKK. Registered controllers declare the categories of data they process, their processing purposes, recipient groups for transfers, and retention periods.
Article 16 of the KVKK provides for a public Registry of Data Controllers kept under the supervision of the Turkish Personal Data Protection Board; VERBIS is the electronic infrastructure of that registry. As a rule, data controllers must register before starting to process personal data, although the Board may exempt certain groups based on criteria such as employee count, annual balance sheet or the nature of the data processed. Each organisation therefore needs to assess its own registration duty. Controllers established abroad register through a representative established in Turkey.
Registration works like an inventory declaration: which data categories are processed, for which purposes, to which recipient groups they are transferred, how long they are retained and which security measures apply. For website owners, the practical point is consistency: the VERBIS declaration must match the site's actual data collection points (forms, accounts, cookies) and its privacy notice. A mismatch between declared purposes and actual processing is an adverse finding in an audit, so the registry entry should be treated as a living document, not a one-off formality.
Frequently asked questions
Who is required to register with VERBIS?
As a rule, data controllers that process personal data must register; however, the Board has exempted certain groups based on criteria such as employee count, annual balance sheet and the nature of the data processed. The duty depends on each organisation's own situation, so checking the authority's current announcements and seeking legal advice in case of doubt is recommended.
How does VERBIS registration relate to the privacy notice?
Both should draw on the same data inventory. The data categories, purposes, recipient groups and retention periods declared in VERBIS must be consistent with what the site's privacy notice describes. Processing data for a purpose missing from the registry, or declaring a transfer in the registry that the notice never mentions, creates an inconsistency. Whenever the inventory changes, both documents should be updated together.
This content is for information only and is not legal advice.