A Public Announcement On The Principle Decision Regarding The Processing Of Biometric Data For Employee Attendance Tracking Has Been Published

The Personal Data Protection Board’s (“Board”) Principle Decision dated 29 April 2026 and numbered 2026/921 on the “Processing of Biometric Data for Employee Attendance Tracking” (the “Principle Decision”) was published in the Official Gazette on 2 June 2026. We had shared our detailed assessments regarding the Principle Decision in our newsletter dated 4 June 2026. Following the publication of the Principle Decision, the Personal Data Protection Authority (“Authority”) published a public announcement (the “Public Announcement”) on 27 August 2026 in response to requests for opinions submitted by data controllers operating in different sectors.

The Public Announcement provides clarification on uncertainties that have arisen in practice and includes further assessments particularly regarding the nature of biometric data, the processing of biometric data for employee attendance tracking purposes, and the scope of the Principle Decision, while the approach adopted under the Principle Decision regarding the use of biometric data for employee attendance tracking purposes is neither changed nor relaxed.

The key points highlighted in the Public Announcement are summarized below:

• The Authority states that, although national legislation does not contain a comprehensive definition of biometric data, Article 3 of Population Services Law No. 5490 defines biometric data as person-specific data obtained from fingerprints, vein patterns and palm prints through electronic systems for identification and authentication purposes.

• Although it was argued in the requests for opinions submitted to the Authority that data obtained through methods such as palm scanning or fingerprinting should not be considered biometric data, the Authority states that converting such data into a mathematical code and storing it in a database does not eliminate its biometric nature.

• The approach adopted under the Principle Decision regarding the processing of biometric data for employee attendance tracking purposes continues to apply. The Public Announcement reiterates that biometric data processing activities carried out solely for employee attendance tracking purposes do not rely on any of the processing conditions set out under Article 6 of the Law and, even where valid explicit consent has been obtained, do not satisfy the proportionality requirement under Article 4 of the Law. Therefore, less intrusive alternative methods should be preferred. For further details, please see our newsletter dated 4 June 2026.

• However, the assessment may differ where biometric data is processed for a purpose other than employee attendance tracking. The Authority states that, particularly in high-security areas, biometric systems may form part of multi-layered security processes such as identity authentication, authorization or controlling access to critical areas. Such use must be limited to the necessary areas and individuals, alternative methods must be insufficient, and the processing must be proportionate to the specific security need.

• Accordingly, the lawfulness of biometric data processing activities falling outside employee attendance tracking purposes must be assessed separately on a case-by-case basis. The Authority states that such activities will not be assessed within the scope of the Principle Decision and that their lawfulness must be assessed by data controllers by taking into account the purpose of processing, the nature of the work and the circumstances of the specific case.

• The Authority also states that the exemption set out under Article 28(1)(ç) of the Law which applies under certain conditions to data processing activities carried out for the protection of national defence, national security, public security, public order or economic security does not provide unlimited scope for the use of biometric data and that the applicability of this exemption must also be assessed on a case-by-case basis. 

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.