- within Litigation and Mediation & Arbitration topic(s)
With the Official Gazette dated 1 October 2025 and numbered 33034, the scope of data controllers exempted from the obligation to register with the Data Controllers' Registry under the Law on the Protection of Personal Data No. 6698 has been expanded. Accordingly, data controllers with fewer than 10 employees and an annual financial balance sheet not exceeding TRY 10 million will now also be considered exempt, even if their main field of activity involves processing special categories of personal data.
Pursuant to Article 16 of the Regulation on the Data Controllers' Registry, titled 'Exemption Criteria,' the Personal Data Protection Board ('Board') may grant exemptions from the registration obligation by taking into consideration the nature of the personal data, the number of personal data processed, the purpose of processing, the field of activity which the data is processed, whether the data is transferred to third parties, whether the data processing activity arises from laws, the retention period of the data, the group of data subjects, or the categories of personal data. In relation to these exemption criteria, with the Board Decision dated 17 July 2018 and numbered 2018/87, as well as the Board Decision dated 2 April 2018 and numbered 2018/32, it was decided that, in addition to the data controllers already exempted, natural or legal person data controllers with fewer than fifty employees and an annual financial balance sheet total of less than TRY 25 million, whose main field of activity is not the processing of special categories of personal data, shall also be exempted from the obligation to register with the Data Controllers' Registry ("VERBIS").
In consideration of the economic conditions in Türkiye, the Board has amended the expression in its Decision dated 17 July 2018 and numbered 2018/87, which previously was "natural or legal person data controllers with fewer than 50 employees and an annual financial balance sheet total of less than TRY 25 million, whose main field of activity is not the processing of special categories of personal data," to "natural or legal person data controllers with fewer than 50 employees and an annual financial balance sheet total of less than TRY 100 million, whose main field of activity is not the processing of special categories of personal data" ("Reassessment Decision").
With the Decision of the Board dated 4 September 2025 and numbered 2025/1572, published in the Official Gazette dated 1 October 2025 and numbered 33034 ("Amendment Decision"), the scope of data controllers exempted from the obligation to register with VERBİS has been expanded. Accordingly, data controllers whose main field of activity involves processing special categories of personal data shall also be exempt from the VERBİS registration obligation, if they employ fewer than 10 employees and their annual financial balance sheet total does not exceed TRY 10 million. In this way, the registration obligation of small-scale data controllers whose main field of activity is the processing of special categories of personal data has been removed.
You can access the Reassessment Decision via this link, and the Amendment Decision via this link (only available in Turkish).
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
