New Regulation Under the KVKK: Exemptions Regarding the VERBİS Registration Obligation Have Been Expanded
With Decision No. 2025/1572 of the Personal Data Protection Board, the exemption criteria regarding the obligation of data controllers to register with the Data Controllers Registry (VERBİS) have been redefined.
Under the previous regulation,
- data controllers with fewer than 50 employees,
- an annual financial balance sheet below 100 million TL, and
- whose main activity did not involve processing special category personal data
were exempt from the VERBİS registration obligation.
With the new Decision, the exemption regime has been extended to data controllers whose main activity is processing special category personal data;
- data controllers with fewer than 10 employees and
- an annual financial balance sheet below 10 million TL
may be considered exempt from the VERBİS registration obligation if the specified conditions are met.
This regulation is expected to directly affect data controllers whose main activity is the processing of special category personal data, which are run by a single person and/or are small-scale businesses (such as boutique clinics, pharmacies, dietitian centres, and similar healthcare providers).
In this context, it is important for the relevant data controllers to:
- review whether they meet the employee number and financial criteria stipulated in the legislation,
- legally assess whether they fall within the scope of the exemption, and
- if they are found to fall within the scope of the exemption, to include the process of deactivating their VERBIS registrations on their agenda.
This is of great importance.