Corporate Tax Returns for the 2025 Fiscal Year Submitted: The VERBIS Registration Process May Have Started for Your Company

Corporate tax returns for the 2025 fiscal year of taxpayers subject to the calendar year basis were submitted between 1-30 April 2026.

Pursuant to the Personal Data Protection Board’s (Board) decision numbered 2023/1154 and dated 06/07/2023, companies with fewer than 50 employees and an annual financial balance sheet total less than TRY 100 million are exempt from Data Controllers’ Registry Information System (VERBIS) registration obligations, provided that their main field of activity is not the processing of special categories of personal data. However, if the relevant balance sheet threshold is exceeded, a VERBIS registration obligation may arise.

The key considerations in this regard are outlined below:

• In the financial balance sheet assessment, the relevant criterion is not turnover or sales revenue, but the total assets/liabilities indicated in the balance sheet attached to the corporate tax return.
• With the submission of the corporate tax return, the 30-day registration and notification period starts for data controllers that subsequently become subject to VERBIS registration obligations.
• The VERBIS obligation is not limited to registration with the registry; it also includes the entry of information such as data categories, processing purposes, retention periods, data transfers, and technical and administrative measures into the system.
• Administrative fines may be imposed in case of non-compliance with VERBIS registration and notification obligations. According to the Personal Data Protection Authority’s 2025 Annual Report, administrative fines exceeding TRY 216 million in total were imposed on 594 data controllers during 2025 due to failures to fulfil their registry registration obligations in due time.
• Based on the administrative fines updated for 2026, data controllers that fail to fulfil their VERBIS obligations may face an administrative fine ranging from TRY 341,809 to TRY 17,092,242, imposed by the Board pursuant to Article 18/1/ç of the Personal Data Protection Law No.6698.