Registration in the data controller registry is not a formality. It is among the first items an audit asks about, and its absence creates a sanction risk independently of whether your data processing itself is lawful.
Short answer: who must register with VERBİS?
Registration in VERBİS (the Data Controllers' Registry) is, as a rule, mandatory for controllers processing personal data; the Board has exempted certain groups by criteria such as employee numbers and annual balance sheet totals. Those exemptions are not absolute: controllers whose principal activity is processing special categories of personal data must register regardless of size. The right question is therefore not "am I small" but what data do I process, for what purpose and at what scale. Because thresholds change, assess scope with your financial or legal adviser and keep the conclusion in writing.
Assessing the obligation
| Criterion | What is examined | Note |
|---|---|---|
| Employee count | Annual average number of employees | Thresholds are set by Board decisions and can change |
| Balance sheet total | Annual financial balance sheet | Assessed together with employee count |
| Principal activity | Whether special category data is processed | If so, scale exemptions do not apply |
| Entity type | Whether it is a public body | Separate arrangements apply to public bodies |
| Establishment | Whether established in Turkey | Separate duties apply to foreign controllers |
The most overlooked row in practice is the third. A small business processing health, biometric or similar data can be in scope regardless of headcount. Starting the assessment from the type of data rather than from size is therefore more reliable.
Building the data inventory
- List data categories. Identity, contact, financial, transaction security, customer transaction, employee records — write down what you collect under each.
- State the purpose for each category. Why do you collect it? Contractual necessity, legal obligation, legitimate interest or explicit consent — state the applicable legal basis.
- Identify recipient groups. Who receives the data: accountants, couriers, payment institutions, cloud providers, public authorities.
- Define retention periods. How long each category is kept and what happens at the end must be written. "Indefinitely" is not a retention period.
- Note transfer status. Domestic or cross-border — where cross-border, state the basis; we covered this in our data residency article.
- Record technical and organisational measures. Access management, backups, encryption, awareness training and similar.
The inventory's greatest value is not as a compliance document but in letting you establish scope quickly during an incident — detailed in our breach notification article.
Registration steps
- Appoint a contact person to run the registration; keep their details current.
- Log into the system and complete the controller details in full.
- Enter the inventory data: categories, purposes, recipient groups, retention periods, transfers, measures.
- Complete the registration and archive a copy in your corporate records.
- Update it when things change. A new data category, a new service provider or an amended retention period all require an update.
Registration is not a one-off task: the duty to keep it current binds as much as the duty to register.
Netişlem expert view: a registration without an inventory can be riskier than none
We encounter two pictures. First, businesses that never registered; second, businesses that filled the registration in by copying template text. The second can carry more risk: where declared information does not match actual practice, the gap is directly visible in an audit. A form completed without an inventory does not achieve compliance; it only attempts to look compliant.
Our second observation is that inventories are usually thought about only in terms of "customer data". Yet employee files, job applications, camera recordings, visitor logs and supplier contact details are personal data too. The most commonly missed item is application documents collected during recruitment and never deleted.
Third, retention periods are frequently left blank. "How long do you keep it" is asked both in the registry and in audits, and most businesses have no answer. Yet setting periods also means disposing of unnecessary data — compliance and risk reduction at once.
Checklist
- Scope assessment completed and the conclusion kept in writing.
- Data inventory produced — category, purpose, legal basis, recipients, period, transfers.
- Employee and candidate data included.
- Camera and visitor records not forgotten.
- Retention period defined for each category with the end-of-period action written.
- Service providers (recipient groups) listed.
- Technical and organisational measures written and genuinely applied.
- Contact person details current.
- Privacy notice consistent with the inventory — see our website compliance audit.
- Annual review scheduled.
Frequently asked questions
If I am exempt from registration, do I still need an inventory?
Exemption from registration does not exempt you from other obligations. Notice, data security, retention and disposal duties continue, and an inventory is a practical necessity for meeting them. A business without one does not know what data it holds or for how long.
What information becomes public through registration?
Part of the registry is publicly accessible, which is why declared information must be accurate and consistent. What is declared is the general framework of processing activity, not commercially sensitive detail.
Who should prepare the inventory?
It is not one department's task. HR, finance, sales and the technical team should each report the data in their processes, with one person coordinating. In small businesses the exercise usually takes half a day.
What if information changes?
The registration must be updated. Engaging a new service provider, starting to collect a new data category or changing a retention period are typical triggers. Defining an internal procedure that prompts updates is a practical solution.
What happens if I do not register?
Failing to register is a separate ground for administrative sanction; in other words, the omission can produce consequences even where your processing is otherwise lawful. That is what sets this obligation apart from other compliance items.
Conclusion
The registry is not the shop window of compliance work but its output. For a business with its inventory ready, registration takes a few hours; without one, the form itself becomes an obstacle. The right order is always the same: write down what you process, then declare it.
To build your data inventory and assess your compliance position, get in touch. You can also review our corporate hosting solutions.