Turkey: Data Protection

The use of biometric recognition systems has become widespread across workplaces, gyms, public institutions and digital services, yet data protection authorities worldwide are increasingly scrutinizing whether such systems are truly necessary or if less intrusive alternatives could achieve the same objectives. Turkey's Personal Data Protection Board has now issued a landmark principle decision that fundamentally challenges employers' reliance on fingerprint and facial recognition systems for time and attend

The Personal Data Protection Board, through its Principle Decision dated 29 April 2026 and numbered 2026/921, has determined that practices involving the processing of biometric data for employee timekeeping purposes are, as a general rule, unlawful data processing activities.

Turkey has implemented a significant reform in the judicial review of regulatory authority decisions, with specialized administrative courts in Ankara now designated to handle technical disputes arising from key regulatory bodies. The new system, effective June 1, 2026, aims to enhance judicial expertise and create more consistent case law in highly regulated sectors including data protection, competition, telecommunications, and energy.

The Turkish Data Protection Authority has issued new guidance addressing the proliferation of complaints regarding security camera usage in workplaces and residential buildings. These announcements establish critical compliance requirements for data controllers who process personal data through video surveillance systems, with non-compliance potentially resulting in administrative sanctions under Turkish law.

Kişisel Verileri Koruma Kurumu'nun 8 Haziran 2026 tarihli kamuoyu duyuruları, apartman ve iş yerlerinde güvenlik kamerası kullanımına ilişkin önemli sınırlamalar getirdi. KVKK'nın temel ilkeleri çerçevesinde, kamera sistemlerinin veri minimizasyonu, ölçülülük ve amaçla bağlantılılık prensiplerine uygun şekilde kullanılması gerektiği vurgulanıyor.

Kişisel Verileri Koruma Kurumu, apartmanlarda güvenlik kamerası kullanımına ilişkin yeni bir kamuoyu duyurusu yayımladı. Duyuru, kamera sistemlerinin 6698 sayılı Kişisel Verilerin Korunması Kanunu ve 634 sayılı Kat Mülkiyeti Kanunu'na uygun şekilde kurulması ve işletilmesi için gereken hukuki çerçeveyi ve teknik gereklilikleri detaylandırıyor.

Kişisel Verileri Koruma Kurulu’nun (“Kurul”) 29.04.2026 tarihli ve 2026/921 sayılı İlke Kararı (“İlke Kararı”), 2 Haziran 2026 tarihli Resmî Gazete’de yayımlanmıştır. Karar, çalışanların mesai ve devam takibinde kullanılan parmak izi, yüz tanıma ve benzeri biyometrik sistemlere ilişkin önemli değerlendirmeler içermektedir.

The Principle Decision of the Personal Data Protection Board (the “Board”) dated 29 April 2026 and numbered 2026/921 was published in the Official Gazette dated 2 June 2026. The Decision contains important assessments regarding the use of fingerprint, facial recognition and similar biometric systems for employee attendance and working hours tracking.

The Turkish Personal Data Protection Board has issued a landmark decision establishing strict limitations on biometric data processing for employee attendance tracking. This ruling challenges the widespread use of fingerprint and facial recognition systems in workplaces, requiring employers to demonstrate that less intrusive alternatives are insufficient before implementing biometric solutions.