Knowledge base

VERBIS registration step by step

The scope of the registration obligation, how the registration is made and how it is kept current.

When to use it: When you learn you are subject to registration, and whenever your processing activities change.

Steps

01
Determine whether you are obliged
Scope and exemptions are set out in the Regulation on the Data Controllers' Registry. Criteria such as employee count and balance sheet come into play; where in doubt, check the Authority's current announcements.
02
Have the inventory ready
The VERBIS form is a summary of your inventory. Without an inventory the registration gets improvised and comes out inconsistent.
03
Appoint the contact person
Someone is assigned to handle communication with the Authority. This person is not the data protection officer; the role is limited to communication.
04
Create the registration
Data categories, processing purposes, recipient groups, retention periods and the measures taken are entered. The entries must match the inventory exactly.
05
Set up change tracking
A new processing activity, a new transfer or a changed retention period requires the registration to be updated. Tie this to a process.

Filling in the registration without an inventory; the two then contradict each other.
Registering once and forgetting about it.
Writing retention periods that differ from what is actually applied.

The guides describe general practice and are not legal advice. Refer to the official source for the current text of the legislation.

The free initial assessment maps your current state and tells you which step should come first. You are not committed to anything afterwards.

Look at it yourself first

A twenty-five question KVKK compliance test with per-area scores and a priority recommendation. No sign-up.

Let's look together

We discuss your current state and work out which step comes first and how long it takes.