Public Announcement by the Authority: Exemption Criteria for VERBİS Registration

Summary

On 4 September 2025, Turkish Data Protection Authority (the "Authority") issued a public announcement clarifying that entities whose principal activity is processing special-category personal data may, under certain thresholds, benefit from an exemption from the obligation to register in VERBİS (the Data Controllers Registry), subject to annual employee count and balance sheet total limits. The announcement provides criteria for this exemption, reminds of the relevant thresholds, and signals that these special rules should be carefully assessed by data controllers. This clarification is especially relevant for smaller organizations handling sensitive data in Turkey.

What the Authority said

In its announcement, the Authority addresses the special case of data controllers whose main/primary activity involves processing special-category personal data (e.g. health, biometric, genetic, etc.). The announcement relates to the question of when such controllers may be exempt from the VERBİS registration requirement under the relevant exception criteria.

Key points from the announcement:

• The Authority states that even when an entity’s core business is special-category data processing, it might qualify for exemption from VERBİS registration if it falls below certain thresholds:

  
  

  • Annual employee count of fewer than 10

  • Annual total balance sheet (financial statement) amount below ₺10 million (Turkish Lira)

    
    

• These thresholds are aligned with those used elsewhere in Turkish legislation and regulations for small entities.

• The announcement underscores that this exemption is not automatic: the entity must verify that it meets all criteria, including that its main activity is indeed special-category data processing, and that the thresholds are satisfied.

• The Authority also reminds stakeholders of the importance of checking whether they fall into this special exempt class before registering or assuming liability, and to document their status appropriately.

• In effect, this is an interpretative clarification of how the existing exemption regime within the VERBİS registration obligation should apply in special-category data cases.

  
  

Why this matters

This announcement has several significant implications for organizations operating in Turkey, especially those dealing with sensitive personal data but of relatively small size.

1. Possible relief for small actors in sensitive domains

Entities that process special-category personal data—such as small health clinics, genetic testing labs, biometric service providers, or small research bodies—often assume that they must register in VERBİS because “sensitive data = no exemption.” This announcement clarifies that even in those cases, an exemption may apply if both the employee threshold and balance sheet threshold are satisfied and special-category processing is their primary activity. For those small actors, this can reduce administrative burden and compliance costs.

2. Caution: the “main activity” requirement is critical

A crucial caveat is that the special-category data processing must be the primary/central line of business, not incidental. If an entity occasionally processes sensitive data but its main business is something else, it likely cannot benefit from the exemption. Firms must carefully evaluate and document this “main activity” status.

3. Thresholds are binding and must be monitored

Even if a small entity qualifies now, growth in staff count or increased financial size may push it over the threshold, thus losing the exemption. Such entities should monitor their metrics continuously and be prepared to register in VERBİS when thresholds are exceeded.

4. Due diligence and documentation are essential

To rely on the exemption confidently in an audit or regulatory scrutiny, organizations should prepare a written internal analysis and justification showing:

• How their core business is special-category data processing;

• That their staff and balance sheet remain beneath the thresholds;

• The date and basis of the assessment.

This documentation helps in demonstrating that the exemption was applied correctly.

5. Context in the evolving regulatory landscape

The Authority’s public announcement is not a change in law but an interpretation—yet it is a significant signal. It helps clarify the application of the exemption as it pertains to sensitive data, removing ambiguity. In Turkey’s data protection environment, such clarifications from the Authority carry strong persuasive weight and may influence enforcement expectations.

Also, this fits into a broader pattern: data protection authorities often provide tailored guidance for small entities and carve-outs to ease burdens. But such carve-outs come with strict conditions—compliance cannot become lax just because a small entity thinks it might qualify.

Key Takeaways

• Entities whose main business is processing special-category personal data may qualify for exemption from VERBİS registration if they employ fewer than 10 staff and have a balance sheet total under ₺10 million.

• The exemption is not automatic — entities must assess and document that they meet all criteria, including that sensitive data processing is indeed their main activity.

• Growth beyond thresholds triggers the need to register in VERBİS, so such entities must monitor their size metrics continuously.

• Maintain internal records (justification, metrics, dates) to support reliance on the exemption in audits or regulatory review.

• This announcement helps reduce uncertainty and clarifies the Authority’s view, but it should be taken as interpretive guidance rather than a change in law.