- within Technology, Accounting and Audit and Transport topic(s)
The Personal Data Protection Authority (“Authority”) has published an important announcement regarding corporate taxpayer legal entity data controllers that have become subject to the obligation to register with the Data Controllers’ Registry (“VERBIS”) due to the criteria relating to the 2025 financial balance sheet total. Within the scope of the announcement, the period granted for the fulfillment of the VERBIS registration and notification obligation has been extended until Friday, 5 June 2026.
Pursuant to the Personal Data Protection Law No. 6698, natural and legal persons processing personal data are obliged to register with VERBIS where certain conditions are met. Although the general registration process has been completed for existing data controllers, the registration obligation continues to apply to data controllers that subsequently fall within the scope of such obligation.
The 2025 financial statements may bring VERBIS obligations back onto the agenda for many companies. Pursuant to the Personal Data Protection Board’s (“Board”) Decision No. 2025/1572 dated September 4, 2025, amending Decision No. 2018/87;
- Data controllers whose principal field of activity is not the processing of special categories of personal data if they employ more than 50 persons annually or if their annual financial balance sheet total is TRY 100 million or above,
- Data controllers whose principal field of activity is the processing of special categories of personal data if they employ more than 10 persons annually or if their annual financial balance sheet total is TRY 10 million or above
fall within the scope of the VERBIS registration and notification obligation.
The Revenue Administration has designated 30 April 2026 as the final date for the submission of corporate tax returns for the 2025 fiscal period. This date is taken as the basis for determining the date on which the VERBIS obligation arises.
In accordance with the Regulation on the Data Controllers Registry, VERBİS registration and notification procedures must be completed within 30 days of the date on which the obligation to register with the Registry arises. While the deadline was originally expected to expire on June 1, 2026, the Board extended the deadline to Friday, June 5, 2026, taking into account the Eid al-Adha holiday.
In the event of a violation of the registration and reporting obligations under VERBİS, administrative fines applicable for the year 2026 can range from 341,809 TL to 17,092,242 TL.
According to the Authority’s 2025 Activity Report, administrative fines amounting to approximately TRY 216.8 million were imposed on 594 data controllers in 2025 solely due to violations of the VERBIS registration and notification obligation. This figure clearly demonstrates that VERBIS is not an obligation that can be disregarded.
In this context, companies must promptly determine whether they are subject to VERBİS obligations based on their 2025 financial statements and, if they fall within the scope of these obligations, complete the registration and notification processes by June 5, 2026. For data controllers already registered with VERBIS, it is important to ensure that the information in the Registry remains consistent with current data processing activities.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
