Glossary · Regulation and data
What is VERBİS, and who has to register?
VERBİS is the online system for Turkey's Data Controllers Registry. The Presidency of the Personal Data Protection Authority set it up. Data controllers use it to register and to keep their entry up to date. The registry is public. A filing lists purposes, groups of people and types of data; it holds no one's actual data.
Last updated: · Author: Şevket Erer, Co-founder, AI Specialist
Why is a VERBİS registration required?
Under KVKK Article 16(2), people and companies that process personal data must register before they start. The Board can exempt some of them. It looks at objective criteria, such as the type and amount of data, whether a law requires the processing, and transfers to others. Board decisions set the scope of the exemption, so check the current criteria on kvkk.gov.tr.
An exemption from registration does not remove the other KVKK duties. You still have to inform people, keep data safe and answer requests (Regulation on the Data Controllers Registry, Article 5(1)(f)). The registry is public, so customers and partners can see there what data a company processes and why (KVKK Article 16(1)).
What goes into a VERBİS filing?
A filing is a summary of the company's personal data inventory: who processes whose data, for what purpose, passing it to whom, with which measures, and for how long. Purposes, groups of people, recipients and transfers abroad are entered under the system's headings based on the inventory (Regulation Article 9(2)). A registration made without an inventory tends to be incomplete.
- Identity and address
Identity and address details of the controller and any representative (KVKK Article 16(3)).
- Purpose
What the personal data will be processed for.
- Groups of people and data categories
The groups of people whose data is processed and the categories of their data, such as customer contact details or employee records.
- Recipients and transfers abroad
The groups of recipients the data may go to, and any data planned for transfer abroad.
- Security measures
The technical and organisational measures taken to keep data secure.
- Retention period
The maximum period needed for the purpose; if any of this changes, the change is reported at once (KVKK Article 16(4)).
An example
An architecture practice holds data on customers, staff and job applicants. It checks the current Board decision to see whether it must register; when it must, it first draws up an inventory: customer contact details are processed for quotes and contracts, staff details for payroll, and project files sit in cloud storage. The VERBİS entry is made from that inventory and updated when a new cloud service is added.
Which misconception about VERBİS comes up most often?
The VERBİS exemption is often discussed among small businesses, and being exempt from registration is often taken to mean being exempt from every KVKK duty. The item gives the common belief, what the Regulation on the Data Controllers Registry says, and the Official Gazette link; the current exemption criteria should be read on kvkk.gov.tr.
Myth: A company exempt from VERBİS registration is exempt from KVKK too.
Fact: The Board's exemption covers only registration; exempt controllers keep their other duties under the Law (Regulation on the Data Controllers Registry, Article 5(1)(f)). Regulation on the Data Controllers Registry, Article 5
The business regulation timeline shows, with official sources, when this rule came into force and where it sits among other business rules.
This page is general information, not legal advice; the regulations were last checked on 25 September 2026. Official text: Personal Data Protection Law (mevzuat.gov.tr), Regulation on the Data Controllers Registry (Official Gazette), VERBİS (verbis.kvkk.gov.tr)
How it looks in Corex360
Corex360 runs in two ways: in a company-specific space on Corex360 Cloud or on your own server, and the choice is written into the agreement. Every sign-in, device and access is logged. Personal data is processed under KVKK (Turkey's personal data protection law). A ready-made VERBİS filing report is not promised; which record is kept where is shown in the demo.
Security and hosting→KVKK: cloud or own server→Corex Drive: files kept with their record→
Terms often confused with it
| Data controller | The data controller is the party that must register; VERBİS is the system it files through. |
|---|---|
| Data processing agreement (DPA) | A data processing agreement sets rules between two companies; a VERBİS entry is the controller's public filing with the Authority. |
Related terms: Data controller, KVKK, KEP (Turkish registered email), Data processing agreement (DPA)
FAQ
Must every company register with VERBİS?
As a rule, individuals and organisations processing personal data register (KVKK Article 16(2)). The Board may exempt some controllers by objective criteria; since the criteria can change by Board decision, check the current decision on kvkk.gov.tr.
Do you enter people's own data into VERBİS?
No. The registry receives purposes, groups of people, data categories, recipient groups, transfers abroad, security measures and the maximum retention period (KVKK Article 16(3)). No customer's name or phone number goes into it.
How does a company based outside Turkey register with VERBİS?
Data controllers based outside Turkey register through a data controller representative before they start processing (Regulation Article 5(1)(b)). The representative is a legal entity established in Turkey or a Turkish citizen (Regulation Article 4(1)(p)).
Was this page useful?