The other obligation foreign companies miss. Registration is separate from the rules on moving data out of Turkey, which changed in 2024 — cross-border transfers and standard contractual clauses.
VERBIS — the Data Controllers' Registry Information System — is a public registry maintained by Turkey's Personal Data Protection Authority. Obligated controllers declare what personal data they process, why, with whom they share it and how long they keep it.
There is no GDPR equivalent, which is why international teams frequently overlook it.
Note: General information, not legal advice. Registration criteria and procedures are set out in Board decisions and can be updated; verify current requirements before acting.
Is it public?
Yes. Anyone can search the registry and see a controller's declaration. Two practical consequences:
- Your declaration and your published privacy notice must tell the same story
- Competitors, customers and journalists can read it
Who has to register?
Obligation is assessed on criteria including annual employee numbers, annual balance sheet totals and main field of activity, with specific treatment for controllers whose core business involves special category data and for controllers established abroad.
Key point for international companies: being established outside Turkey does not by itself remove the obligation. Where a foreign controller falls within scope, Turkish rules also contemplate the appointment of a representative in Turkey — and in that case, registration is generally expected to be completed before processing begins.
Because thresholds and exemption lists change, treat this as a question for Turkish counsel rather than a self-assessment.
The Turkey-resident representative
This is the step foreign controllers discover last and it blocks everything else: a controller established outside Turkey cannot simply register itself. It has to appoint a representative in Turkey first, and the registration is carried out through that representative.
Who can be one. Article 11 of the Regulation on the Data Controllers Registry limits the role to a legal entity resident in Turkey or a natural person who is a citizen of the Republic of Türkiye. An employee of your parent company abroad cannot hold it, and neither can a non-Turkish consultant based in Turkey.
How the appointment is made. By a decision of the controller, and that decision has to grant the representative at least five specific powers:
| # | Power the appointment decision must grant |
|---|---|
| 1 | Receiving and accepting notifications from the Authority on the controller's behalf |
| 2 | Conducting correspondence regarding the Authority's requests |
| 3 | Receiving data subject applications on the controller's behalf |
| 4 | Delivering the responses to the data subjects |
| 5 | Carrying out all Registry transactions on the controller's behalf |
A certified copy of that decision is submitted to the Authority at the point of registration — so the decision has to exist and be in the right form before you start the registration, not alongside it.
A legal entity representative still needs a named human. Appointing a Turkish company as representative does not remove the contact-person requirement; contact person details are entered into the Registry at registration either way.
What this means in practice. The representative is not a mailbox. They receive regulator notifications and data subject requests on your behalf, and the clock on responding starts when they receive it. Choose someone who will actually forward things, and give whoever it is a written internal escalation path.
We do not act as data controller representative and this article does not offer that. The appointment is a legal relationship with real exposure and it should be set up with Turkish counsel. What we do is the documentation that surrounds it — see the done-for-you compliance service.
What the Board has actually decided about foreign controllers
Two published Board decisions settle questions international teams ask most often. Both are primary sources; we link the summaries below.
A representative office in Turkey brings the whole foreign entity into scope — Decision 2020/471 (23 June 2020). A foreign bank with a Turkish representative office asked whether it was a data controller under Law No. 6698 and whether it had to register. The office itself could not take deposits or lend; it only promoted the bank and did market research. The Board held that those activities are inseparable from the bank's processing, cited the EDPB's territorial-scope guidelines (3/2018) on the same point, and concluded that the bank is a data controller subject to the Law and must register with VERBIS. It also restated Article 5(1)(b) of the Registry Regulation: controllers not established in Turkey must register through their representative before they start processing. If your group has any permanent presence in Turkey that feeds the parent's business, assume this decision applies to you.
One person can be the contact person for several foreign controllers — Decision 2020/542 (16 July 2020). Registration through a representative requires naming a natural-person contact person. For Turkish-established controllers the Board's earlier position (2019/299) is one contact person per controller, because that person must know the inventory well enough to update VERBIS within seven days of any change. For controllers established abroad the Board accepted the practical difficulty of finding specialised people and ruled that the same representative may act for several foreign controllers and the same natural person may be the contact person for several of them. This is why representative service providers can run a portfolio.
The same decision restates what the representative's appointment must cover (the five powers in the table above) and that a certified copy of the appointment decision is filed at registration.
Registration flow for a foreign controller, step by step
- Decide whether you are in scope. Data about people in Turkey plus any Turkish presence or targeting (Decision 2020/471 sets the bar low). If unsure, this is a counsel question, not a self-assessment.
- Appoint the representative by a formal decision of the competent corporate body, listing at least the five powers. Have the decision certified; the registration will not proceed without the certified copy.
- Name the contact person. A natural person (may be shared across your group's foreign entities under 2020/542); give them written access to the inventory.
- Build the inventory first — see the table below. The declaration is a transcription of the inventory, not the other way round.
- Register through the representative's VERBIS account, upload the certified appointment decision, enter the declaration.
- Diary the seven-day update rule. New vendor, new data category, new purpose, address change: the declaration must be updated within seven days of the change, not annually.
What the declaration asks for
Have this ready before you start — it is essentially your processing inventory:
| Field | What to prepare |
|---|---|
| Controller identity | Legal name, tax/registry numbers, address, contact details |
| Representative (if applicable) | Details of the Turkey-based representative |
| Contact person | A natural person for correspondence |
| Data categories | Identity, contact, financial, HR, health, transaction security, etc. |
| Data subject groups | Customers, employees, candidates, suppliers, visitors |
| Purposes | Concrete, per-process purposes |
| Recipients | Accountants, cloud providers, payment institutions, public authorities |
| Cross-border transfers | Countries and mechanisms |
| Retention periods | Per data category |
| Security measures | Technical and organisational measures actually in place |
If you don't yet have an inventory, build it first — see the compliance checklist.
After registration
- Seven-day rule: any change (new vendor, new data category, address change) must be reflected in VERBIS within seven days of the change — the Board restated this in Decisions 2019/299 and 2020/542 (an earlier version of this article said 30 days; that was wrong)
- Keep it consistent: update the privacy notice and the declaration together
- Annual review: read your own declaration once a year and confirm it still describes reality
Common mistakes by international teams
- Assuming EU registration covers it — there is no mutual recognition
- Naming a contact person who never checks the mailbox — official correspondence goes unread
- Declaring aspirational security measures — declare what you actually do
- Registering once and forgetting — the update obligation is where breaches accumulate
- Copying the group privacy notice without reflecting Turkish lawful bases
FAQ
Is there a fee?
The Authority does not charge a registration fee. Costs are internal preparation time or advisory fees.
Can our local employee in Turkey be the representative?
Only if they are a citizen of the Republic of Türkiye — residence alone is not enough for a natural person. Otherwise the representative has to be a legal entity resident in Turkey. Note also that the role carries duties towards the Authority and towards data subjects; it is not an administrative formality.
Can our Turkish law firm register on our behalf?
Someone you authorise can complete the submission, but the accuracy of the declaration remains the controller's responsibility.
Do branches register separately?
Registration follows legal personality. Branches of the same legal entity are not registered separately; distinct legal entities are.
What if we conclude we're not obligated?
Keep the evidence supporting that conclusion (headcount, balance sheet, activity description). Other KVKK obligations still apply regardless.
Sources
- Regulation on the Data Controllers Registry (Veri Sorumluları Sicili Hakkında Yönetmelik) — Turkish Personal Data Protection Authority — Article 11 sets who may be a representative, the powers the appointment decision must grant, and the submission of a certified copy at registration
- Board Decision 2020/471 — foreign bank with a Turkish representative office is a data controller and must register (summary, Turkish)
- Board Decision 2020/542 — one natural person may be contact person for several foreign controllers; seven-day update duty (summary, Turkish)
- Law No. 6698 on the Protection of Personal Data (full text, Turkish)
- Turkish Personal Data Protection Authority
- 313 Board decision summaries as an open dataset (JSON/CSV, CC BY 4.0) — the two decisions above are records 2020/471 and 2020/542
Thresholds, exemption lists and Board practice change. Rely on the Authority's current publications and Turkish counsel before acting.
Prepare in one pass: KVKK Otomat builds the inventory and a VERBIS preparation list from your process map, so the declaration becomes data entry rather than research. Background reading: Turkish data protection law guide.
No time to do it yourself? We prepare the Turkish document set for you — including cross-border transfer mapping and an English explanatory memo. Done-for-you service, from EUR 450. The tools stay free either way.
