With the announcement of the Personal Data Protection Authority on July 25, 2023, the criteria for exceptions to the Data Controllers Registry ("VERBIS") registration obligation have been updated.

Pursuant to Law No. 6698 on the Protection of Personal Data, the Personal Data Protection Authority is authorized to make exceptions to the obligation to register with the Data Controllers Registry and to determine the scope and methods of application of these exceptions. According to the previous regulation, data controllers whose main activities are not based on the processing of special categories of personal data and whose number of employees is less than fifty (50) annually and annual financial statement total is less than twenty-five million Turkish Liras (TRY 25.000.000) were exempted from the obligation to register with VERBIS.

However, considering the recent growth in economic indicators and expansion in business volumes of enterprises, the definition of "small enterprise" has been revised with the updates made in the "Regulation on Small and Medium-Sized Enterprises". According to the new definition, a "small enterprise" is defined as an enterprise with less than fifty (50) employees annually and whose annual net sales revenue or financial statement does not exceed one hundred million Turkish liras (TRY 100.000.000).

In this context, with the decision of the Personal Data Protection Board dated 06.07.2023 and numbered 2023/1154; it has been decided to exempt real or legal person data controllers, whose main activity is not processing specially qualified personal data and who have less than 50 employees per year and an annual financial statement of less than 100 million Turkish liras, from the obligation to register in the registry; the limit of 25 million Turkish Liras has been raised to 100 million Turkish Liras.

With this change, many small businesses will be exempt from the obligation to register with VERBIS.