Data controller registry (VERBIS): who must register and how

If you run a small business with ties to Turkey, someone — an accountant, a business partner, maybe a compliance vendor — has probably asked whether you have registered with VERBIS. For a lot of owners, the honest answer is: "I've heard the term, but I have no idea if it applies to me." Search results do not help much either; a lot of what is written about the data controller registry online is old, contradictory, or quietly built around numbers that may no longer be current.

This article explains what VERBIS is, who is likely to fall under the obligation to register, and how the registration process generally works. One disclaimer upfront: this is general, educational information, not legal advice. Thresholds, exemptions and deadlines change over time, and the only reliable source for current rules is Turkey's Personal Data Protection Authority (KVKK Kurumu, kvkk.gov.tr).

What is VERBIS?

VERBIS stands for "Veri Sorumluları Sicil Bilgi Sistemi" — literally, the Data Controllers' Registry Information System. It is an online registry, run by Turkey's Personal Data Protection Authority under Law No. 6698 (KVKK, Turkey's data protection law), where organizations and individuals that process personal data declare how they do it.

The idea is straightforward: if a business processes personal data belonging to customers, employees or suppliers, it discloses why it collects that data, what categories it holds, who it shares it with, and how long it keeps it. VERBIS is the central place where those disclosures live. Other jurisdictions run similar registries under their own data-protection laws; VERBIS is simply Turkey's version, built for transparency and accountability rather than paperwork for its own sake.

Who might be required to register?

Under KVKK, any person or organization that processes personal data can be a "data controller," and data controllers are, as a rule, expected to register with VERBIS. But whether your specific business must register in practice depends on criteria — sector, annual turnover, headcount, the type of data processed — that the Personal Data Protection Authority sets and periodically revises.

We are deliberately not going to hand you a number here. A line like "businesses with more than a certain number of employees must register" might be accurate today and wrong by the time you read this. Instead:

• Check the current criteria directly: the Personal Data Protection Authority publishes exemption and scope decisions on its official site, and they vary by size and sector.
• Ask an advisor who knows your business: an accountant or lawyer familiar with your sector, headcount and the kind of data you process can give you a concrete answer.
• Do not assume you are automatically out of scope: being small does not guarantee an exemption — some activities trigger the obligation regardless of size.

Exemptions shift too

The Personal Data Protection Authority periodically issues decisions exempting certain sectors or smaller data controllers from the registration requirement. These have, at different times, covered specific professions or businesses under certain size thresholds. What matters is that the list, the thresholds and who qualifies have changed before and can change again.

Treat an old forum post or a years-old article citing an exemption threshold as a hypothesis, not a fact, and confirm against the current published list before deciding the obligation does not apply to you.

Why the registration matters

Registering with VERBIS can feel like pure bureaucracy, but it doubles as a useful exercise: it forces a business to actually map what data it holds, why, and for how long — often for the first time, right there on the form.

Registering is not the point. Knowing exactly what data you hold, and why, is the point VERBIS forces you to reach.

Failing to register when you are obligated to can carry administrative penalties. We will not quote a figure here, since those amounts are revised periodically — check the Personal Data Protection Authority's current announcements for that.

The general registration steps

The exact screens and required fields can change as the system is updated, so treat the following as the general shape of the process rather than a click-by-click guide.

1Apply2Verify identity3Build data inventory4Submit declaration

In practice, a data controller — or its registered representative — first applies with identifying information. Then comes the part that takes the most time: entering the categories of data processed, the purposes of processing, the groups the data is transferred to, and the security measures in place. This step assumes you have already inventoried your data; most delays come from not having that ready. Finally, the declaration is reviewed and submitted.

What information does a VERBIS record actually contain?

Registering is not a single checkbox; it is closer to producing a map of your entire data-processing activity.

VERBISrecordIdentity detailsProcessing purpos…Data categoriesRecipient groups

Each of these headings is filled in differently depending on your business. An online store might declare customer names, addresses and order history; a small real-estate agency might declare contact details for prospective buyers and sellers. What matters is filling this in based on what you actually do, not a guess.

Preparing before you register: build the data inventory first

The slowest part of a VERBIS application is rarely the form itself — it is answering, honestly, "where do we actually keep this data?" In small businesses the answer is often scattered: some in WhatsApp threads, some in a spreadsheet, some in an employee's personal inbox.

This is where a properly organized system earns its keep. Businesses that already understand what a CRM actually does and keep customer records in one traceable place tend to get through the inventory stage much faster. If your data is still spread across a dozen spreadsheets, planning a move away from that — see this guide on migrating from Excel to a CRM — is a reasonable first step before you even open the registration form.

• List every place data lives: CRM, email, accounting software, paper files — put them all on one list before you start the form.
• Note who can access what: knowing which employee can see which data matters for both the inventory and basic security hygiene.
• Review retention periods: ask why you are still holding a given piece of data, and set a deletion plan for anything that has outlived its purpose.

Common mistakes worth avoiding

Most of the trouble businesses run into with VERBIS is not technical — it is attitude.

• Assuming "this does not apply to us": skipping the research tends to create a scramble later, once someone flags the obligation.
• Registering once and forgetting about it: a VERBIS declaration is meant to reflect current activity — start processing a new data category or add a new recipient, and the record needs updating, not a one-time filing.
• Trusting a "guaranteed registration" pitch blindly: plenty of vendors sell registration services; confirm independently, through the official authority, that you are actually in scope before paying anyone.

Is registering with VERBIS the same as being data-protection compliant?

No — and this is one of the most common mix-ups. Registering with VERBIS covers one obligation among several under KVKK. After registration, ongoing responsibilities continue: preparing a privacy notice, setting up valid consent flows, applying security measures, and responding to data subject requests such as access, correction or deletion.

This article deliberately stays focused on the registry itself, not the full compliance picture. For the practical side of collecting, storing and deleting customer data lawfully inside a CRM, see our guide on building a data-protection-compliant CRM setup.

After registration: keeping it current

Registering is not the finish line. As your data processing changes — a new marketing tool, an overseas vendor, a new employee handling personal data — your VERBIS declaration is expected to keep up. Using a system with solid CRM features for visibility into who accessed what data and when makes that ongoing upkeep considerably less painful.

For growing businesses, it is worth folding this into how you evaluate tools generally: when comparing options with a guide like choosing the best CRM for a small business, add data governance and reporting to your checklist alongside the usual pipeline and inbox features.

Frequently asked questions

Registering with VERBIS can look like one more bureaucratic hoop, but treated properly it is a decent forcing function: it pushes a business to finally answer who holds what data and why. Once you have confirmed the current thresholds and exemptions with the Personal Data Protection Authority, the practical next step is usually the same one that makes daily operations easier anyway — getting customer records out of scattered files and into one place. A CRM like Rocketly, built for that kind of consolidation, is a reasonable starting point for a small team getting organized before it registers.