VERBİS (the Data Controllers' Registry Information System) is a public registry, kept by the Personal Data Protection Authority, in which data controllers exceeding certain thresholds under KVKK must register. A correct VERBİS registration rests on a solid data inventory — the two are inseparable. This guide covers who must register, how to build the inventory, how to register step by step, and how to keep it up to date.
What Is VERBİS and Why Does It Matter?
VERBİS registration is not a compliance "formality". The processing purposes, data categories, retention periods and transfers you declare are among the first documents examined in a Board audit. If your declarations contradict your actual practice, that alone can be grounds for a sanction.
VERBİS is also public: your partners, customers and competitors can view your registration. An incomplete or careless entry creates not only a legal but a reputational risk. So treat VERBİS not as "a form to fill once and forget" but as the shop window of your compliance programme.
Who Must Register?
As a general rule, the following data controllers must register with VERBİS:
- Those with more than 50 employees annually,
- Those whose annual balance-sheet total exceeds the set threshold,
- Those whose main activity is processing special-category data (regardless of headcount),
- Data controllers established abroad.
The Board has exempted certain controllers — for example some professional groups, and associations, foundations and unions processing data only about their own employees and members. But exemptions are interpreted narrowly. "We are small, we are out of scope" is one of the most common mistakes; do not decide without assessing your situation against the concrete criteria.
Data Inventory First: The Foundation
Before entering VERBİS you must prepare a personal data processing inventory. It is the raw material of the registration and answers the following questions:
| Field | What it answers |
|---|---|
| Data-subject group | Whose data? (employee, customer, visitor…) |
| Processing purpose | Why do we process it? |
| Legal basis | Which article do we rely on? |
| Retention period | How long do we keep it? |
| Transfer | To whom/where do we transfer it? (domestic/abroad) |
| Security measure | Which technical/administrative measures are in place? |
Fill the inventory with real processes from the field, not the "ideal" from your desk. Interviewing departments one by one — HR, marketing, sales, IT and customer service — reveals real data flows. In these interviews most companies discover processing activities and transfers they were not aware of.
Step-by-Step VERBİS Registration
- Assess scope: Evaluate the thresholds and exemptions against your own situation. When in doubt, lean toward registering.
- Complete the data inventory: Map real processes department by department; clarify the purpose and legal basis for each activity.
- Designate a contact person: Appoint the person who will handle communication with VERBİS and the Board. This person is not a "DPO"; their core function is communication.
- Create the registration: Declare processing purposes, data categories, recipient groups, retention periods and transfers.
- Align declarations with practice: Every item must match your actual practice exactly; leave no gap between the inventory and VERBİS.
- Complete within the deadline: Do not miss the deadlines tied to when your registration obligation arose.
Example Scenario: An E-commerce Company With 60 Employees
Say you are an e-commerce company with 60 employees. You are in scope because headcount exceeds 50. During the inventory you discover: customer order data is held with a foreign cloud provider (cross-border transfer), the marketing team sends newsletters via an e-mail tool (processor + probable transfer), and HR keeps candidate CVs indefinitely (retention-period risk). Your VERBİS registration must reflect all three correctly; otherwise a declaration-versus-practice contradiction arises.
Keeping the Registration Up to Date
VERBİS is not a one-off task. When you start a new processing activity, add a new transfer or change retention periods, you must update the registration. The way to make this sustainable is to keep the inventory as a living document and to define in advance the events (new software, new vendor, new product) that trigger an update.
Common Mistakes
- Filling the inventory with the "ideal" rather than real processes.
- Leaving retention periods vague ("as long as needed").
- Failing to declare cross-border transfers (especially cloud/SaaS).
- Registering once and never updating.
- Treating the contact person as a DPO and assigning the wrong authority/responsibility.
- Assuming intra-group data sharing is an "internal operation" and not assessing it as a transfer.
Checklist
- Scope and exemption assessment done.
- Department-level data inventory completed.
- Legal basis documented for each processing activity.
- Retention periods defined and justified.
- Domestic/cross-border transfers listed.
- Technical and administrative security measures written down.
- Contact person appointed.
- VERBİS registration created and aligned with practice.
- Update process (triggers + owner) defined.
- Consistency between inventory and registration reviewed periodically.
Frequently Asked Questions
We have fewer than 50 employees — are we definitely exempt?
No. You may still be in scope due to criteria such as the balance-sheet threshold or a main activity of processing special-category data. Headcount is not the only criterion.
Can we comply with KVKK without a VERBİS registration?
KVKK obligations (notice, security, explicit consent, etc.) apply independently of VERBİS. But if you are within the registration scope, registration is also mandatory; one does not replace the other.
Is the contact person the same as a DPO?
No. The contact person is mainly for communication; they do not carry the same authority and responsibility as the GDPR's independent DPO.
How often should I update the inventory?
Update it based on triggering events rather than a fixed calendar: whenever a new system, vendor, product or transfer is added. Also carry out a holistic review at least once a year.
This content is for general information only and does not constitute legal advice. With JUS. you can build your data inventory on a single platform and align it with your VERBİS declarations — request a demo.