Under the Turkish Personal Data Protection Law No. 6698 (“DP Law”), the thresholds applicable to the registration and notification obligations before the Data Controllers’ Registry Information System (“VERBIS”) are determined pursuant to the decisions of the Personal Data Protection Board (“Board”). Within this scope:
- Pursuant to the Board’s Decision dated 19.07.2018 and numbered 2018/87, data controllers employing fewer than 50 employees are exempt from the VERBIS registration obligation.
- With the Board’s Decision dated 06.07.2023 and numbered 2023/1154, the financial balance sheet threshold was updated to TRY 100 million.
- Pursuant to the Board’s Decision dated 04.09.2025 and numbered 2025/1572, data controllers whose main field of activity involves processing special categories of personal data are exempt from the VERBIS obligation if they employ fewer than 10 employees and have an annual financial balance sheet total below TRY 10 million.
Data controllers becoming subject to the VERBIS registration obligation based on their 2025 annual financial balance sheet total were originally required to complete their registration and notification obligations by 30 May 2026. However, with the Board’s Decision dated 13.05.2026 and numbered 2026/1026, the relevant deadline has been extended until 5 June 2026.
Accordingly, data controllers established in Türkiye whose 2025 annual financial balance sheet total exceeds the applicable threshold are required to complete their VERBIS registration and notification obligations by no later than 5 June 2026.
You may access the full text of the extension decision through this link. (Only available in Turkish).
