Skip to main content

Compliance · KVKK / VERBIS

KVKK / VERBIS data protection registration

Any company processing personal data of Turkish residents — customer lists, employee records, website forms — must register with VERBIS (Turkish data controller registry). KVKK is Turkey's GDPR-equivalent; the fines are serious. We register, draft the data inventory, and publish the privacy notice.

Who this is for

  • Foreign e-commerce sellers with Turkish customer lists
  • Turkish subsidiaries of foreign groups (inherit group DPO or appoint local)
  • SaaS companies with Turkish users
  • Any employer with Turkish staff
  • Property managers holding tenant data

What's included

  • VERBIS registration with the Turkish Data Protection Authority
  • Data inventory mapping (data category × purpose × retention × recipient)
  • Privacy notice (Aydınlatma Metni) drafting in Turkish + English
  • Explicit consent flows (for sensitive data or international transfer)
  • International transfer safeguards (SCC-equivalent, consent, or derogation)
  • Data Protection Officer (DPO) appointment or coordination with group DPO

Scope & SMMM disclosure

We deliver the full engagement under SMMM (Certified Public Accountant) scope — preparation, filings, advisory, and ongoing compliance. For YMM certification reports, statutory audits, and court representation we coordinate with vetted partners. You get one point of contact and one invoice.

Frequently asked questions

Do I need VERBIS if I have no Turkish employees?

Possibly yes — if you process Turkish residents' personal data (e.g. e-commerce customers, website analytics) you may be in scope. We run a short eligibility check first.

What are the penalties?

Turkish KVKK fines range from tens of thousands to low millions TRY per violation. The real cost is reputational for multinationals subject to enforcement.

Ready to start?

Book a free 20-minute call. We scope your situation and give you a clear fixed-fee quote.

Book your free call