Amendment to the Exemption Criteria Regarding VERBIS Registration Obligation

Under the Personal Data Protection Board’s Decision dated September 04, 2025, and numbered 2025/1572 (Board Decision), the exemption criteria regarding the obligation of data controllers whose main field of activity involves processing special categories of personal data to register with the Data Controllers’ Registry Information System (VERBIS) has been revised.

As per the current practice, data controllers with fewer than 50 employees and an annual financial balance sheet total below TRY 100 million were exempt from VERBIS registration, provided that their main field of activity was not the processing of special categories of personal data. However, certain data controllers — such as physicians’ private practices, pharmacies, and laboratories — whose primary activities inherently involve processing special categories of personal data, were still subject to the registration requirement even if they met these financial and employment thresholds.

Pursuant to the Board Decision, data controllers whose main business activity is the processing of special categories of personal data and who employ fewer than 10 people with an annual financial balance sheet below TRY 10 million, are now covered by the exemption. This amendment has been published in the Official Gazette dated October 01, 2025, and numbered 33034 and entered into force on the same date.