Public Announcement by the Authority: Exemption Criteria for VERBİS Registration

Summary

On 1 October 2025, the Turkish Data Protection Authority (the “Authority”) announced a decision of the Personal Data Protection Board (the “Board”), dated 4 September 2025 and numbered 2025/1572, which was published in the Official Gazette the same day. The decision extends the exemption from the obligation to register in VERBİS (the Data Controllers Registry) to entities whose principal activity is processing special-category personal data, subject to annual employee count and balance sheet total limits. Until then, the size-based exemption expressly left those entities out. The change is especially relevant for smaller organizations handling sensitive data in Turkey.

What the Authority said

In its announcement, the Authority addresses the special case of data controllers whose main/primary activity involves processing special-category personal data (e.g. health, biometric, genetic, etc.). The announcement relates to the question of when such controllers may be exempt from the VERBİS registration requirement under the relevant exception criteria.

Key points:

• The Board decided that even when an entity’s core business is special-category data processing, it is exempt from VERBİS registration if it falls below both of these thresholds:

• Annual employee count of fewer than 10

• Annual total balance sheet (financial statement) amount below 10 million TL

• These thresholds are aligned with those used elsewhere in Turkish legislation and regulations for small entities.

• The exemption is not something to assume: the entity must verify that it meets all criteria, including that its main activity is indeed special-category data processing, and that both thresholds are satisfied.

• An entity should therefore check whether it falls into this exempt class before registering or assuming the obligation, and document its status appropriately.

• This is a new exemption, not an interpretation of an existing one: the Board amended its 2018 exemption decision (2018/87, as amended by 2023/1154) under Article 16(2) of Law No. 6698, and the amendment took effect on its publication in the Official Gazette on 1 October 2025.

Why this matters

This announcement has several significant implications for organizations operating in Turkey, especially those dealing with sensitive personal data but of relatively small size.

1. Possible relief for small actors in sensitive domains

Entities that process special-category personal data—such as small health clinics, genetic testing labs, biometric service providers, or small research bodies—often assume that they must register in VERBİS because “sensitive data = no exemption.” Until this decision they were right: the size-based exemption expressly excluded them. The decision changes that: an exemption now applies if both the employee threshold and balance sheet threshold are satisfied and special-category processing is their primary activity. For those small actors, this can reduce administrative burden and compliance costs.

2. Caution: the “main activity” requirement is critical

A crucial caveat is that the special-category data processing must be the primary/central line of business, not incidental. If an entity occasionally processes sensitive data but its main business is something else, this is not the exemption that applies to it: it falls under the Board’s general size-based exemption instead (fewer than 50 employees and an annual balance sheet under 100 million TL), which is wider. Firms must carefully evaluate and document this “main activity” status.

3. Thresholds are binding and must be monitored

Even if a small entity qualifies now, growth in staff count or increased financial size may push it over the threshold, thus losing the exemption. Such entities should monitor their metrics continuously and be prepared to register in VERBİS when thresholds are exceeded.

4. Due diligence and documentation are essential

To rely on the exemption confidently in an audit or regulatory scrutiny, organizations should prepare a written internal analysis and justification showing:

• How their core business is special-category data processing;

• That their staff and balance sheet remain beneath the thresholds;

• The date and basis of the assessment.

This documentation helps in demonstrating that the exemption was applied correctly.

5. Context in the evolving regulatory landscape

The Board’s decision is not an interpretation but a change to who must register: it was adopted under Article 16(2), published in the Official Gazette, and took effect on publication. It removes the ambiguity that surrounded small controllers in sensitive sectors, and the Authority’s announcement makes the change visible to them.

Also, this fits into a broader pattern: data protection authorities often provide tailored guidance for small entities and carve-outs to ease burdens. But such carve-outs come with strict conditions—compliance cannot become lax just because a small entity thinks it might qualify.

Key Takeaways

• Entities whose main business is processing special-category personal data may qualify for exemption from VERBİS registration if they employ fewer than 10 staff and have a balance sheet total under 10 million TL.

• The exemption is not automatic — entities must assess and document that they meet all criteria, including that sensitive data processing is indeed their main activity.

• Growth beyond thresholds triggers the need to register in VERBİS, so such entities must monitor their size metrics continuously.

• Maintain internal records (justification, metrics, dates) to support reliance on the exemption in audits or regulatory review.

• The exemption rests on a Board decision under Article 16(2), in force since its publication in the Official Gazette on 1 October 2025: a change to the registration regime, not interpretive guidance.