İstanbul, Türkiye | Publication | May 2026

Extension of the VERBIS Registration Deadline for Companies Subject to Registration Obligation

Authors: Senem Gölge Yalçın, Selin Önbilgin

The Personal Data Protection Authority (“Authority”) has extended the deadline for fulfilling the registration and notification obligations before the Data Controllers’ Registry (“VERBIS”) for corporate data controllers that became subject to VERBIS registration for the first time due to their 2025 financial balance sheet totals, pursuant to the Authority’s Decision dated 13.05.2026 and numbered 2026/1026.

As is known, following the revision of the thresholds set forth under the Personal Data Protection Board’s (“Board”) Decision No. 2018/87 through the Board’s Decision dated 04.09.2025 and numbered 2025/1572, the following data controllers are now subject to the VERBIS registration obligation:

  • Corporate data controllers that are corporate tax payers, whose main field of activity is not the processing of special categories of personal data, and whose 2025 financial balance sheet total is TRY 100 million or above; or
  • Corporate data controllers that are corporate tax payers, whose main field of activity is the processing of special categories of personal data, and whose 2025 financial balance sheet total is TRY 10 million or above.

Pursuant to the Regulation on the Data Controllers’ Registry, data controllers becoming subject to the registration obligation are required to complete their VERBIS registration and notification procedures within 30 days following the date on which such obligation arises.

As the Revenue Administration determined 30.04.2026 as the deadline for submission of corporate tax returns for the 2025 fiscal year, companies falling within the scope of the registration obligation would ordinarily have been required to complete their VERBIS registration and notification procedures by 30.05.2026 at the latest.

However, considering that:

  • 30.05.2026 falls on a public holiday; and
  • the final week of the 30-day period coincides with the Eid al-Adha holiday period,

the Board resolved to extend the relevant deadline in order to prevent potential inconvenience for data controllers. Accordingly, the deadline for fulfilling the VERBIS registration and notification obligations has been extended until Friday, 05.06.2026.