For businesses that process personal data, one of the most important obligations is the duty of data controllers that meet certain conditions to register with the Data Controllers’ Registry Information System (Veri Sorumluları Sicil Bilgi Sistemi, VERBİS).

VERBİS is a publicly accessible registry in which natural and legal persons that process personal data declare certain information about their data processing activities. The aim of this system is to ensure transparency in personal data processing and to increase the accountability of data controllers.

However, VERBİS registration on its own does not mean that KVKK obligations have been fulfilled. Registration is only one part of the personal data compliance process.

What Is VERBİS?

VERBİS is the Data Controllers’ Registry Information System set up under the Law on the Protection of Personal Data No. 6698 (KVKK).

Through this system, data controllers declare the categories of personal data they process, the purposes for which they use this data, to whom they may transfer it and the data retention periods.

The VERBİS system is a mechanism that records personal data processing activities and allows people to access certain information about data controllers.

Who Is a Data Controller?

To understand the VERBİS obligation, you first need to know the concept of the data controller (veri sorumlusu).

A data controller is the natural or legal person who determines the purposes and means of processing personal data and who is responsible for setting up and managing the data filing system.

Companies, associations, foundations, institutions or other organisations that process personal data may qualify as data controllers depending on the nature of their activities.

Who Must Register with VERBİS?

Data controllers that meet the conditions set under the KVKK must register with VERBİS.

When assessing the registration obligation, criteria such as the nature of the data controller, the number of employees, the size of the annual balance sheet and the types of data processed are taken into account.

It cannot be said that every business must automatically register with VERBİS. However, whether a business falls within the obligation must be assessed legally.

Criteria Considered for the VERBİS Registration Requirement

There are some basic criteria for determining the VERBİS obligation. Among them, the economic size of the business, the number of employees and its field of activity play an important role.

In addition, different assessments may apply to some data controllers that process special categories of personal data (özel nitelikli kişisel veri).

For this reason, the decision should be made not only by looking at the size of the company but by examining its actual data processing activities.

How Do You Apply to VERBİS?

The VERBİS application is made by the data controller logging in to the system and declaring the required information electronically.

During the application, information about the data controller is entered into the system first. Then the categories, purposes, retention periods and transfer details relating to the personal data processing activities are specified.

For the VERBİS declaration to be prepared correctly, the business’s data processing activities must have been analysed beforehand.

Information to Be Declared to VERBİS

VERBİS records contain various information about the business’s personal data processing activities.

In general, the declaration states information such as:

The data controller’s identity and contact details,
The purposes of processing personal data,
The categories of data processed,
The groups of data subjects,
The persons or institutions to which the data may be transferred,
The retention periods of the data.

How Should a VERBİS Registration Be Prepared?

A VERBİS declaration is not just a technical form-filling exercise. The information declared must be consistent with the company’s actual activities.

Incomplete or inaccurate declarations may leave the company in a risky position under the KVKK.

For example, if the company processes employee data but these activities are not correctly included in the VERBİS declaration, this may amount to non-compliance.

Does VERBİS Registration Ensure KVKK Compliance?

One of the most common misconceptions about VERBİS registration is to treat the registration as the whole of KVKK compliance.

In fact, KVKK compliance is a broader process. Many areas must be assessed together, such as the duty to inform, explicit consent processes, data security measures, the protection of employee data and retention and destruction policies.

VERBİS is only the registration and declaration stage of this comprehensive compliance process.

The Relationship Between VERBİS and the Personal Data Inventory

To make a sound VERBİS declaration, the business’s personal data inventory must first be created.

A company cannot create a correct VERBİS registration without knowing which data it processes, why it collects this data, to whom it transfers it and how long it stores it.

For this reason, data analysis is one of the stages that form the basis of the VERBİS process.

The Obligation to Update VERBİS

Companies’ activities may change over time. VERBİS information may need to be updated when new services are offered, different categories of data start to be processed or data transfer processes change.

Out-of-date registry records may cause a mismatch with companies’ actual data processing activities.

Consequences of Not Complying with the VERBİS Obligation

Administrative sanctions may apply if the obligations that must be fulfilled under the KVKK are breached.

For this reason, companies should not only keep track of VERBİS registration dates but also regularly review all their personal data management processes.

A Legal Approach to the VERBİS Process for Companies

VERBİS registration is one of the important tools that help companies build a transparent and controlled structure in personal data management.

However, a correct VERBİS process requires analysing the business’s actual activities, identifying data flows and aligning the registration details with legal processes.

For businesses that process personal data, managing the VERBİS obligation correctly is important not only for meeting a legal requirement but also for ensuring corporate data security.