New Exemption in VERBİS Registration Requirement
With the decision (the “Decision”) of the Personal Data Protection Authority (the “PDPA”) published in the Official Gazette dated 01/10/2025 and numbered 33034, an exemption from the VERBİS registration obligation has been introduced for certain small-scale enterprises.
By updating the wording in the Personal Data Protection Board’s Decision dated 19/07/2018 and numbered 2018/87, as amended by the Decision dated 06/07/2023 and numbered 2023/1154, the Board further ruled that “data controllers, whether natural or legal persons, whose main field of activity involves processing special categories of personal data, but who employ fewer than 10 employees and whose annual financial balance sheet total is less than TRY 10 million” shall also be exempt from VERBİS registration.
As of its publication, the Decision establishes two categories of VERBİS exemptions:
- Enterprises that were already exempt prior to the Decision, i.e. those employing fewer than 50 employees, with an annual financial balance sheet total below TRY 100 million, and whose main field of activity does not involve processing special categories of personal data,
- Enterprises newly exempted by the Decision, i.e. those whose main field of activity is the processing of special categories of personal data, but who employ fewer than 10 employees and whose annual financial balance sheet total is below TRY 10 million.,
Accordingly, small-scale entities such as medical practices, dental clinics, pharmacies and laboratories are now exempt from the obligation to register with VERBİS. Enterprises that have already registered with VERBİS may apply to the PDPA for deregistration, provided that they meet the exemption criteria.
Successful