KVKK Representative & VERBIS Checklist
For data controllers established outside Türkiye
This checklist helps an organisation established outside Türkiye review its obligations under Personal Data Protection Law No. 6698 and the Data Controllers’ Registry (VERBIS) rules. Mark each answer for your own review. The page does not calculate a legal conclusion: the first decision is whether the entity is a controller subject to Turkish requirements and whether a specific registry exception applies.
Step 1: Scope and registration
Is the organisation established outside Türkiye?
Identify the legal entity that decides why and how the personal data is processed; a service provider may instead be a processor.
Does that entity process personal data in a way that calls for a Turkish KVKK assessment?
Document the Turkish activities, people concerned, collection channels and processing purposes. Do not assume that the GDPR territorial-scope test is the Turkish test.
Have you checked the statutory and Board-issued VERBIS exceptions?
A foreign controller should not assume that a small workforce or turnover creates an exemption. Any claimed exception needs a specific legal basis.
If registration is required, is the foreign controller correctly registered in VERBIS?
Check the registered entity, data inventory, contact details and whether the record still matches actual processing.
Step 2: Representative appointment
Has the foreign controller formally appointed a data controller representative?
The authorised corporate body or person should adopt an appointment decision; a service agreement alone may not satisfy the registry procedure.
Is the appointee eligible under the Turkish registry rules?
The representative must be a legal person established in Türkiye or a Turkish citizen natural person.
Does the decision give the representative the required authority?
The minimum scope includes receiving Authority communications, forwarding requests and responses, handling data-subject applications as prescribed, and VERBIS transactions.
Have the certified decision and contact-person details been handled for VERBIS?
The registry rules require submission of the certified appointment decision and entry of a contact person. The contact person has a different role from the representative.
Are privacy notices, rights requests and overseas transfers reviewed separately?
A representative does not replace the controller’s substantive KVKK duties or the separate Article 9 transfer analysis.
How to Use Your Answers
If you identified a foreign controller with a Turkish registration obligation and answered “No” to any appointment or registry question, review that gap promptly. A “Yes” to all questions does not confirm full KVKK compliance. A claimed exemption should be checked against the current Board decisions. Foreign controllers are not assessed against the domestic employee-count and balance-sheet thresholds for the start of their VERBIS registration duty.
What the Representative Does
Under Article 11 of the Registry By-Law, the appointment decision must cover communications with the Authority, relevant data-subject applications and registry transactions. The foreign controller remains responsible for its obligations; appointing a representative does not transfer that responsibility.
Official Sources and Next Step
Review the Data Controllers’ Registry By-Law, the Authority’s registry-exception decisions and its representative guidance. For a company-specific review, contact our team. See also our GDPR and KVKK comparison.