Exemption from VERBİS Registration for Data Controllers Whose Main Activity Is Processing Special Categories of Personal Data

As is well known, pursuant to Article 16(1) of the Law on the Protection of Personal Data No. 6698 (“Law”), which stipulates that “Under the supervision of the Board, the Presidency shall maintain the Data Controllers’ Registry publicly,” natural and legal persons processing personal data are required to register with the Data Controllers’ Registry Information System (“VERBİS/Registry”). Article 16(2) of the Law further provides that the Personal Data Protection Board may introduce exemptions to the registration obligation, taking into account objective criteria such as the nature and volume of the personal data processed, whether the processing arises from law, or whether data is transferred to third parties.

In this context, the Decision of the Personal Data Protection Board dated 4 September 2025 and numbered 2025/1572 (“Decision”) regarding the Exemption Criteria from the Obligation to Register with VERBİS for Data Controllers Whose Main Field of Activity Involves Processing Special Categories of Personal Data was published in the Official Gazette on 1 October 2025.

Pursuant to the Decision, data controllers who:

• Primarily engage in processing special categories of personal data,

• Employ fewer than 10 employees, and

• Have an annual financial balance sheet total of less than TRY 10 million,

are exempted from the obligation to register with VERBİS.

As is already the case, data controllers who:

• Employ fewer than 50 employees,

• Have an annual financial balance sheet total of less than TRY 100 million, and

• Do not primarily engage in processing special categories of personal data,

are also exempted from the obligation to register with VERBİS.

In the announcement published by the Personal Data Protection Authority, the reasoning behind the Decision was explained with reference to the economic conditions of Türkiye and the fact that data controllers classified as micro-enterprises under the Regulation on Small and Medium-Sized Enterprises (“SMEs”) have limited personnel and financial resources. It was also underlined that such enterprises lack sufficient capacity for legal and IT expertise and, compared to others, process only a limited volume of personal data. The Decision is particularly significant for businesses whose main field of activity involves processing special categories of personal data, such as pharmacies, medical practices, and laboratories.