VERBIS for Foreign Companies in Turkey: Data Controller Representative, Article 16 and Registration

1. KVKK Article 16 establishes a public Data Controllers’ Registry

Article 16(1) of Personal Data Protection Law No. 6698 provides that the Data Controllers’ Registry is kept publicly available by the Presidency under the supervision of the Personal Data Protection Board. Article 16(2) states the general rule that natural and legal persons processing personal data must register before starting data processing, subject to exemptions that the Board may create using objective criteria.

The online system through which registration operations are carried out is VERBIS—the Data Controllers’ Registry Information System. Registration is not a licence to process personal data. The By-Law expressly states that registration does not remove any other obligation under Law No. 6698.

A controller must therefore satisfy the substantive processing rules separately: Article 4 principles, Article 5 and Article 6 processing conditions, Article 10 transparency, Article 12 security, Article 13 data-subject request procedures and Article 9 cross-border transfer requirements where relevant.

2. Controllers not established in Turkey have a specific registration route

The Registry By-Law Article 5(1)(b) states that data controllers not established in Turkey are obliged to register with the Registry through their representatives before the start of data processing. The Authority’s current VERBIS guide separately explains the foreign-controller workflow.

The first legal question is therefore whether the foreign person or company is a data controller within the scope of Law No. 6698. Under Article 3, the controller is the natural or legal person that determines the purposes and means of processing and is responsible for establishing and managing the data filing system. A foreign company should not appoint a representative merely because it supplies software to a Turkish customer if, in the concrete processing operation, it acts only as a processor under the customer’s instructions; the controller/processor role must be mapped accurately.

Conversely, a foreign group company that independently determines why and how personal data are processed cannot avoid controller obligations merely by calling itself a service provider in a contract. The actual decision-making role controls the classification.

A foreign group with a Turkish subsidiary should also distinguish the entities. The Turkish subsidiary is a Turkish-established legal person and is assessed under the rules for Turkish controllers; the foreign parent remains a separate controller where it independently determines purposes and means for processing within the Law’s scope.

3. The data controller representative must meet a statutory location/status test

The By-Law defines the representative of a data controller not established in Turkey as either a legal person established in Turkey or a natural person who is a Turkish citizen, authorised at least to perform the matters listed in Article 11(3).

The Authority’s current VERBIS guidance adds the practical residence requirement for the natural-person route: the appointed individual must be a Turkish citizen resident in Turkey. A foreign individual who is not a Turkish citizen cannot be appointed in the individual-representative capacity described by the current VERBIS guide.

A Turkish legal person—such as a Turkish company—can serve as representative if validly appointed and able to perform the Article 11 functions. The appointment should identify the Turkish legal entity precisely, including registered title and identifying details, and the internal signatory who will act for that representative should have valid corporate authority.

The representative is not the foreign controller itself. It is the Turkish-facing legal interface through which the foreign controller carries out Registry operations and communications prescribed by the By-Law.

4. The foreign controller must adopt a formal representative appointment decision

Registry By-Law Article 11(2) requires the representative of a data controller not established in Turkey to submit a certified copy of the competent body’s or person’s representative-designation decision to the Authority during the application.

The Authority’s current VERBIS guidance likewise instructs foreign-established natural and legal person controllers first to appoint a data controller representative. The representative enters the foreign controller’s information into VERBIS, generates the application form and submits the signed application together with the certified appointment decision to the Authority through the accepted physical or electronic route.

The appointment decision should be adopted by the organ or person with authority under the foreign controller’s governing law. For a foreign corporation, that may be the board or another competent corporate body. The authority chain should be clear enough for the Turkish Authority to verify that the representative was validly designated.

Foreign documents should be authenticated and translated as required for use in Turkey. The appointment decision should not merely state “privacy representative.” It should include the minimum functions prescribed by Article 11(3), because the By-Law expressly requires those matters to be covered.

5. Article 11(3) specifies the representative’s minimum authority

The representative-designation decision must cover at least five operational functions. First, the representative must receive or accept notifications and correspondence from the Authority on behalf of the foreign controller.

Second, the representative must transmit requests made by the Authority to the foreign controller and submit the controller’s responses back to the Authority. Third, unless the Board determines another procedure, the representative must receive Article 13 requests made by data subjects on behalf of the controller and transmit them to the foreign controller.

Fourth, the representative must transmit the foreign controller’s responses to data subjects under Article 13(3), again unless another Board procedure applies. Fifth, the representative must perform Registry operations on the foreign controller’s behalf.

These are not optional service descriptions invented by contract. They come directly from the Registry By-Law. A representative agreement can add operational detail—service levels, security, confidentiality, escalation, document retention and fees—but it should not remove the minimum statutory functions.

6. The Turkish data controller representative and the VERBIS contact person are different roles

The By-Law distinguishes the representative of the data controller from the contact person. Article 11(4) requires representatives of controllers not established in Turkey to enter contact-person information into the Registry at registration.

The Authority’s current foreign-controller workflow states that after the representative logs in, it appoints a natural person who is resident in Turkey and a Turkish citizen as the contact person. The contact person then logs into VERBIS and completes the information entry required for registration.

The contact person is not legally authorised to represent the data controller merely because of the VERBIS appointment. Article 11(4) expressly states that the contact person is not authorised to represent data controllers under the Law and the By-Law.

This distinction matters for notices, data-subject applications and legal responsibility. The representative performs the statutory representation/communication functions; the contact person is the operational Registry contact. Neither appointment removes the foreign controller’s substantive responsibility under Law No. 6698.

7. The current VERBIS registration workflow for a foreign controller is document-driven

The Authority’s current guide explains the foreign-controller registration sequence. The Turkish representative first uses the “Data Controller Login” route and enters the foreign controller’s own information: legal title/name, e-mail, telephone, address, country of establishment and the date/number of the representative appointment decision where applicable.

The system then generates a PDF application form. The form is submitted in the accepted manner—physically as a signed/sealed document or through the permitted registered-electronic-mail route—together with the certified representative appointment decision.

After the Authority evaluates the application, it sends the user credentials to the e-mail address stated in the application. The representative then logs into VERBIS, appoints the qualifying contact person, and the contact person completes the substantive Registry notification.

The Authority specifically warns that foreign controllers must not enter the Turkish representative’s or contact person’s identity as though it were the foreign controller’s own identity. The foreign controller remains the controller being registered.

8. VERBIS registration must be based on a personal-data processing inventory

Registry By-Law Article 5(1)(ç) requires controllers under a registration obligation to prepare a personal-data processing inventory, and states that the information submitted to the Registry is prepared based on that inventory.

The By-Law defines the inventory as a structured record of processing operations by business process, including processing purposes and legal bases, data categories, recipient groups, maximum retention periods, data-subject groups, data envisaged to be transferred abroad and data-security measures.

This means VERBIS should not be completed by selecting broad menu items without first mapping the foreign controller’s actual Turkish-relevant processing. The Registry filing should be consistent with privacy notices, retention policy, processor/vendor contracts, Article 9 transfer mechanisms and internal security documentation.

The public Registry contains categories and processing information, not a database of the underlying personal data. The Authority explains that VERBIS is designed to publish who the controllers are and categorical information about their processing so data-protection rights can be exercised more effectively.

9. Domestic size thresholds do not exempt foreign-established controllers

Turkey has Board-created VERBIS exemptions for certain Turkish-established controllers based on annual employee count, annual financial balance sheet and whether the main activity consists of processing special-category data. The current domestic thresholds include the 50-employee/TRY 100 million test for ordinary controllers and, following Board Decision No. 2025/1572, the 10-employee/TRY 10 million test for controllers whose main activity is special-category data processing.

Those size thresholds should not be imported into the foreign-controller analysis. The Authority’s current “Correctly Known/Incorrectly Known” guidance states expressly that Board Decision No. 2019/387 requires all data controllers established abroad to register and that employee count and annual financial balance sheet are not exemption criteria for foreign-established controllers.

The current “Questions on VERBIS” guide says the same: when determining the registration obligation and start date for controllers established outside Turkey, annual employee count, financial balance sheet total and whether the main activity involves special-category data are not taken into account.

10. Registry changes must be notified through VERBIS within seven days

Registry By-Law Article 13 requires data controllers to notify the Authority through VERBIS within seven days of a change in Registry records. This is a continuing obligation after initial registration.

Changes that can require action include the representative, contact person, controller information, processing purposes, data categories, recipient groups, overseas-transfer information, security measures or maximum retention periods where the Registry entry becomes inaccurate.

Foreign companies should include Turkish VERBIS review in global corporate-change processes. A merger, name change, registered-office change, privacy restructuring, new cloud deployment or acquisition can affect the Turkish Registry entry even when the business change is initiated outside Turkey.

If the foreign controller stops the relevant processing and the registration obligation ends, Registry By-Law Article 14 provides an erasure-application process through VERBIS. Erasing the Registry record does not remove obligations that arose while the controller was registered.

11. VERBIS registration and cross-border transfer compliance are separate obligations

VERBIS records include personal data envisaged to be transferred to foreign countries. That Registry entry does not itself authorise the cross-border transfer. Law No. 6698 Article 9 must be satisfied independently.

Since the 2024 Article 9 amendment, a recurring cross-border transfer ordinarily requires an adequacy decision or an appropriate safeguard such as a Board-published standard contract, binding corporate rules or an approved written commitment, together with the Article 5 or Article 6 processing condition. Incidental exceptions apply only within their statutory limits.

For the complete current transfer mechanism, see Cross-Border Data Transfer from Turkey: KVKK Article 9.

A foreign controller should reconcile the Registry entry with its actual transfers. If VERBIS says no overseas transfer is envisaged but the processing architecture sends Turkish personal data to multiple foreign cloud or group systems, the controller has a consistency problem requiring immediate review.

12. The Authority actively enforces failures to register and notify

Law No. 6698 Article 18(1)(ç) provides an administrative-fine basis for breach of the Article 16 Registry registration and notification obligations. The amounts written into the base statute are subject to the legally applicable annual administrative-fine revaluation framework; the current-year payable range must therefore be checked for the year of enforcement.

The Authority’s public enforcement notice reported active VERBIS investigations against controllers identified as having a registration obligation but failing to comply, including controllers established both in and outside Turkey. The existence of a foreign head office is therefore not a practical reason to ignore the Registry.

The representative and contact-person appointments also do not transfer liability away from the foreign controller. The Authority expressly states that responsibility under Law No. 6698 remains with the foreign data-controller legal person and its competent governing organ; appointing a Turkish representative does not eliminate that responsibility.

Foreign businesses using a Turkish branch should keep corporate registration and data protection separate. The branch route is explained in Foreign Company Branch in Turkey: TCC Article 40. Whether the foreign parent, branch operation or another group company is the data controller must be determined from the real processing decisions.

Conclusion

VERBIS compliance for a foreign company in Turkey is not determined by the domestic 50-employee or TRY 100 million size thresholds. A foreign-established data controller within the scope of Law No. 6698 is in the separate foreign-controller registration group and must use a Turkish data controller representative that meets the By-Law requirements.

The practical sequence is clear: identify the true controller, appoint a qualifying Turkish representative by a valid corporate decision, submit the certified appointment document and application, appoint a qualifying contact person, prepare the personal-data processing inventory, complete VERBIS accurately, and update Registry information within seven days when it changes. Cross-border transfer, privacy-notice and security obligations remain separate and must be satisfied alongside registration.