New Exception For The Verbis Registration Obligation

With the decision of the Personal Data Protection Board dated 04.09.2025, published in the Official Gazette on 01.10.2025, another exemption has been introduced with respect to the obligation to register with VERBIS.

Data controllers whose annual number of employees is LESS than 50 and whose annual balance sheet total is less than TRY 100 million, and whose principal activity is not the processing of sensitive personal data, were already exempt from the VERBIS registration obligation. With the new decision, data controllers whose principal activity is the processing of sensitive personal data, but who employ less than 10 employees with an annual balance sheet total of less than TRY 10 million, will no longer be required to register with VERBIS.

Accordingly, small-scale enterprises whose main activity involves the processing of sensitive personal data — such as opticians, pharmacies, small medical practices, dental clinics, and laboratories — have been exempted from the VERBIS registration obligation, provided they meet the above conditions