Expanded VERBIS Exemptions for Small-Scale Data Controllers
Article 16 of the Law No. 6698 on the Protection of Personal Data (“KVKK”) requires data controllers to register with the Data Controllers’ Registry (“VERBIS”). To reduce compliance burdens for smaller organizations, the Personal Data Protection Board (“the Board”), has introduced and recently expanded certain exemptions.
Under the Board’s decision dated 6 July 2023 (No. 2023/1154), data controllers with fewer than 50 employees and an annual balance sheet total below TRY 100 million were exempt from VERBIS registration, provided that processing special categories of personal data is not their primary activity.
The Board’s Decision dated 4 September 2025 and numbered 2025/1572 widened the scope of this exemption. The earlier exemption remains in place. In addition, the following group is now also exempt:
Data controllers whose primary activity involves processing special categories of personal data,
With fewer than 10 employees, and
Annual balance sheet below TRY 10 million.
Under KVKK Article 6, special categories of personal data include: race, ethnic origin, political opinions, religion, association or union membership, health data, sexual life, criminal convictions, security measures, biometric data, and genetic data. These categories require enhanced protection due to their sensitive nature.
This amendment represents a significant shift for small businesses whose core operations involve processing special category personal data. Previously, this area that was previously ineligible for any VERBIS exemption.
For more information on the data protection law and what these changes mean for your organization, please contact your CMS partner or local CMS expert: Erdinç Dalar.
