What Is VERBİS Registration? Who Is Required to Register?

The Data Controllers' Registry Information System (VERBİS) is the public registry kept by the Personal Data Protection Board under Article 16 of the KVKK, where organizations that process personal data must enroll. In effect, it is a "who processes which data, and why" table.

Who Is Required to Register?

Based on the Board's decisions, the current thresholds are as follows:

• Real and legal persons acting as data controllers (established in Türkiye) with more than 50 employees per year, or an annual financial balance sheet exceeding 100 million TL.
• Real and legal persons acting as data controllers established abroad (no threshold applies).
• Data controllers with fewer than 50 employees and a balance sheet not exceeding 100 million TL, but whose principal line of business is processing special categories of personal data (e.g. hospitals and clinics).
• Public institutions and organizations (no threshold applies).

Who Is Exempt from Registration

• SMEs with fewer than 50 employees, a balance sheet below 100 million TL, and no processing of special categories of data;
• Civil society associations (subject to certain exceptions);
• Some SMEs that only process the data of their own employees.

Even where registration is not required, the KVKK's other obligations (disclosure, data security, responding to data subjects' rights) apply to every data controller.

The Registration Process, Step by Step

1. Appoint a contact person: the staff member who will manage KVKK processes (usually a KVKK specialist or legal counsel).
2. Log in via e-Devlet: the legal entity's representative accesses the VERBİS system through e-Devlet.
3. Enter company details: trade name, tax number, address, contact information, and sector.
4. Declare data categories: identity, contact, financial, customer transaction, visual/audio, health, and so on.
5. Specify processing purposes: marketing, customer relations, logistics, employee HR, and the like.
6. List data subject groups: customers, employees, visitors, suppliers, etc.
7. Declare the parties data is transferred to: suppliers, public institutions, recipients abroad.
8. State retention periods: for each data type.
9. Describe security measures: encryption, access control, and so on.
10. Confirm and submit the declaration.

The VERBİS Registration Deadline

Registration is required within 30 days of the date you become subject to the obligation or exceed the threshold. Late registration or incomplete notification is subject to penalties.

Penalties

The 2026 penalties for breaching the VERBİS registration obligation are:

• Failing to notify, or notifying late: 54,000 – 2,700,000 TL
• Incorrect or incomplete notification: within the same range

The Obligation to Keep Records Current

VERBİS records are not "frozen." As a company's processing activities change (a new system, a new partnership, a new service), those changes must be reflected in the registry. A review at the end of the financial year is recommended.

How Does SignLogger Help with VERBİS Preparation?

Most of the information you need to complete a VERBİS notification comes from your own systems: who accesses which kind of data, for how long, and under which security measures. SignLogger's audit logs and retention policies provide concrete documentation for your VERBİS declaration:

• System access audit logs (evidence of security measures);
• Automated retention and deletion policies (for declaring retention periods);
• Hash-chained log files (evidence of integrity measures);
• Reports on users with 2FA enabled (evidence of authentication measures).

For details, explore SignLogger's features.

VERBİS Registration, Step by Step

1. Preparation: Build your data inventory — categories, purposes, recipient groups, and retention periods. The VERBİS form draws on this inventory.
2. Application: Register through verbis.kvkk.gov.tr using the data controller manager login; activate the account with the code sent to your registered notification address.
3. Appoint a contact person: Designate the individual (resident in Türkiye) who will handle correspondence with the Authority.
4. Complete the notification: Enter your data categories, processing purposes, transfer recipients, and retention periods — and don't forget the "network traffic / log records" category.
5. Keep it current: Update the notification whenever your inventory changes; registration is not a one-time task but a living obligation.

Common VERBİS Mistakes

• Leaving log records out of the inventory: Wi-Fi and firewall logs contain personal data and must be declared as a category. For details, see KVKK and Log Management.
• Entering retention periods as "indefinite": The Board does not accept this; for logs, reference the statutory period set out in Law No. 5651 (retention period guide).
• Miscalculating the threshold: Employee count and balance sheet thresholds can be updated each year by Board decisions; always check the current figures.

Frequently Asked Questions

I'm below the threshold — do I really not need to do anything?

You are exempt from VERBİS registration, but all of the KVKK's other obligations (disclosure, security, disposal, breach notification) still apply in full.

What happens if I don't register?

Breaching the VERBİS obligation is subject to substantial administrative fines under KVKK Article 18; for the amounts, see our article KVKK Penalties 2026.