VERBİS for hotels: when a hotel has to register

VERBİS is Türkiye's Data Controllers' Registry under Law No. 6698. A hotel must register before it starts processing personal data unless a Personal Data Protection Board decision exempts it. Exemption turns on employee count, balance sheet total, main activity and special categories of data, so only your accountant and counsel can apply it to your facility.

A general manager searches for a straight answer, finds three pages quoting three different employee numbers, and forwards them to the accountant. The question behind the search is simple, but the answer is not a single figure. It is a test that uses your own headcount, your own balance sheet and what your facility actually does. After reading this article you will know what VERBİS is, which two figures decide the duty, and what to bring to the meeting with your accountant and counsel.

What is VERBİS, in plain words?#

VERBİS is the Data Controllers' Registry, a register kept under Law No. 6698 (KVKK, the personal data protection law) in which a controller declares what personal data it processes, for which purposes, and who receives it. The duty comes from Article 16(2): natural and legal persons that process personal data must register before they start processing, unless the Personal Data Protection Board exempts them. The Kişisel Verileri Koruma Kurumu's public announcement of 12 January 2026 (opens in a new tab) describes how the exemption decisions apply.

In general terms, an entry describes the controller, its representative, a contact person, the purposes of processing, the categories of data, the groups of recipients, retention, transfers abroad and the security measures taken. The registry form walks you through the fields one by one. Registration is a declaration, not a certificate: it records what you said on the day you filed it, and it does not by itself make the processing lawful.

It is also not the same thing as a breach notification, a consent record or a transfer undertaking. Those are separate duties that exist whether or not you register. For a hotel, the register entry sits on top of the everyday work: notices at the front desk, consent where it is the right basis, staff access rules and retention periods. We cover those daily practices separately in KVKK for hotels: notices, consent, staff access and retention.

Does my hotel have to register in VERBİS?#

A hotel has to register if it processes personal data and no Board exemption covers it. Being a hotel is neither an obligation nor an exemption: the answer depends on the size and nature of the processing, measured by criteria the Board has published. Article 16(2) lets the Board grant exemptions on objective criteria such as the nature and amount of the data, processing required by law, or transfer to third parties.

Those criteria are applied in Board decision 2018/87 (19.07.2018), which has been amended twice. Decision 2023/1154 (06.07.2023) raised the balance-sheet limit to 100 million TL, and decision 2025/1572 (04.09.2025) added a second group of exempt controllers. The exemption is built around two questions: is processing special categories of personal data your main activity, and how large are you by employee count and balance sheet total.

The main activity test looks at what the business does, not at what it occasionally touches. A resort whose main activity is accommodation is in a different position from a facility whose main activity is a medical wellness program, and that distinction is a question for counsel, not for a search engine. The test is applied per legal entity: a management company, a property owner and a group brand may be separate controllers with separate answers.

Special categories of data under KVKK include health data. In a hotel this can appear in spa and wellness records, allergy and dietary notes, and any biometric access system.

The two exempt groups as the decisions now read#

Source: KVKK public announcement of 12 January 2026 on the application of decision 2025/1572. The thresholds are amended from time to time, so confirm the decision in force on the date you decide.

Which figures decide it, and who holds them?#

Two figures decide it, the annual employee count and the annual balance sheet total, and both belong to your accountant. The general manager holds the headcount reality; counsel reads the current decision. Neither figure is a guess.

The employee criterion is an annual employee count, not the number of people on shift in August. Seasonal staff, outsourced housekeeping and contracted security raise questions your adviser has to answer for your case. The balance sheet total comes from the annual balance sheet, so the accountant is the only person who can state it with confidence.

Board decision 2025/2393 (25.12.2025) settles how the two criteria combine. Controllers that keep balance-sheet-basis books are assessed on both criteria together, and controllers that do not keep balance-sheet-basis books are assessed on the annual employee count alone. That means two hotels of similar size can reach different conclusions depending on which books they keep. Do not copy a neighbouring hotel's answer.

The thresholds change. The 2018 decision has already been amended twice, so record the date on which you checked which version applies. Write the conclusion down: the two figures, their source documents, the decision you relied on and the date. A file that shows how you decided is worth more than a verbal assurance.

If you must register, what does it involve?#

Registration is a written inventory of your processing, a named contact person, and a retention and destruction policy that says when data is destroyed. None of these can be produced from a software menu; they come from how your hotel actually works.

Build the inventory from the guest journey rather than from the software menu: reservation, check-in and the identity notification, the stay, billing, camera footage, staff files and marketing lists each produce their own purposes, data categories and recipients. Name a contact person (irtibat kişisi). It is a role, not a title: the person named must be able to answer the Board and must know where the inventory and the policy are kept.

The retention and destruction policy is required for controllers that must register, under the Regulation on the Deletion, Destruction or Anonymization of Personal Data (opens in a new tab) (Official Gazette, 28 October 2017, in force 1 January 2018). Periodic destruction happens at intervals fixed in that policy, and those intervals may not exceed six months. Controllers without such a policy are given three months; treat that as a deadline to plan for, not a grace period to rely on.

When a person asks for deletion and all processing conditions have ended, the controller must delete, destroy or anonymize the data, inform the person within thirty days at the latest, and notify any third party it transferred the data to. Keep the inventory and the policy as versioned documents with dates, because the register entry is only as good as the documents behind it. For the front desk side of these requests, see Guest data requests under KVKK: a front office procedure.

The registration file in six items#

How do you keep the registration current?#

Treat the registration as a living record and revisit it whenever a system, an outlet, a processor or a legal entity changes. A static entry becomes wrong quietly, and the wrong entry is what the Board reads.

Systems: a new property management system, a new channel manager, a new guest app or a new marketing tool each add purposes and recipients that were not in the original inventory. Physical operations: new camera coverage, a new spa or wellness unit, a new beach or ski outlet, or a new biometric access point can change both the data categories and the main activity question. For cameras specifically, our CCTV in hotels under KVKK checklist covers notices, placement and footage.

Processors: a support contract or a cloud service that moves data outside Türkiye changes the transfer answer. Check that before the contract is signed, not after. Structure: a new hotel in the group, a change of management company or a closure changes who the controller is and what the entry should say.

People: a change of contact person is easy to forget and easy to fix. Put it on the same list as the accountant's year-end calendar. Run an annual review tied to the balance sheet date, because the exemption test uses annual figures, and re-read the current Board decisions at the same time.

What should you ask your counsel and accountant?#

Ask a short set of questions, get the answers in writing, and record the date, because the conclusion is only defensible if it shows its working. The questions are about facts and about the current text of the decisions, not about opinions.

Ask counsel which version of the Board decisions was in force on the date of the decision, and whether any amendment is pending. Ask the accountant for the two figures in writing, with the document they come from. Ask who inside the hotel owns the inventory and the policy, and who signs when they change. Ask what would change the answer: a new outlet, a new system, a new processor, a group restructuring. Ask what happens if the answer changes next year, so that the review has an owner and a date rather than good intentions.

What to do next#

Book a single meeting with a fixed agenda: bring the annual employee count, the balance sheet total, the type of books you keep and the current Board decision, and leave with a written conclusion and a date. Everything in this article feeds that one page. If the conclusion is that you must register, the inventory and the retention and destruction policy are the first two documents to write, because the register entry is only a summary of them. If the conclusion is that you are exempt, keep the page anyway: the exemption is a position you have to be able to explain later, and the thresholds can move.