VERBİS

Under the law, people and organisations that process personal data must register with the Data Controllers' Registry before they start, although the Board may grant exemptions on objective criteria. The long-standing exemption covers controllers with fewer than 50 employees a year and an annual balance-sheet total below 100 million lira, provided their main activity is not processing special category data.

Board decision 2025/1572 of 4 September 2025 added a second exemption: controllers whose main activity is processing special category data are exempt with fewer than 10 employees a year and an annual balance-sheet total below 10 million lira. For controllers without balance-sheet accounts, only the employee count applies.

Whether a health business's main activity falls into this group needs its own assessment, and an exemption from registration is not an exemption from the rest of the law. If you are registered, your privacy notice must match what you declared to the registry.