Fingerprint clock-in and clock-out, turnstiles with facial recognition, or palm readers… In recent years, many organizations that want to digitalize staff attendance tracking have turned to biometric systems. The Kişisel Verileri Koruma Kurulu (the Personal Data Protection Board, "the Board") adopted a principle decision on this practice, numbered 2026/921 and dated 29 April 2026. The decision was published in Resmî Gazete (Türkiye's Official Gazette) No. 33268 of 2 June 2026. On 27 August 2026, the Kişisel Verileri Koruma Kurumu (KVKK, Türkiye's Personal Data Protection Authority), for its part, published a public announcement responding to requests for opinions on the decision.
In this article, we summarize what the decision and the announcement say, staying close to the source texts. The article is for general information only and does not replace legal advice. For your own practice, you should obtain an assessment from your legal counsel.
Why did the Board adopt a principle decision?
According to the introduction of the decision, one of the issues most often encountered in the reports and complaints reaching KVKK is organizations turning to biometric identification systems to digitalize employee attendance tracking and increase security. The Board relies on Article 15, paragraph 6, of Law No. 6698 (Türkiye's Personal Data Protection Law, "the Law"): this provision provides for the Board to adopt and publish a principle decision where it finds a violation to be widespread.
The decision lists fingerprints, facial recognition, and iris and retina scans as examples of biometric data. It also draws attention to an important characteristic of such data: once compromised, it can be neither changed nor taken back. A password can be changed when it leaks; a fingerprint cannot.
The decision's three key findings
In its conclusion section, the text of the decision highlights three assessments.
1. The "expressly provided for by law" condition is not met. According to the decision, the İş Kanunu (the Labor Law) and the Çalışma Süreleri Yönetmeliği (the Regulation on Working Hours) impose an obligation on employers to monitor working hours and to document them by appropriate means. However, there is no express statutory provision calling for such monitoring to be carried out with biometric systems. The Board therefore states that biometric attendance tracking cannot be based on this processing condition.
2. Explicit consent is not treated as a sufficient basis on its own. The decision finds that, in practice, these activities are mostly based on the employee's explicit consent. In the Board's view, the imbalance of power in the employer-employee relationship raises serious doubt as to whether consent rests on free will. Where refusing to give consent could have negative consequences for the employee, the decision considers that the employee cannot be said to have a genuine choice. The decision also points out that the possibility of withdrawing consent at any time would undermine the continuity of the system.
3. The proportionality principle is not satisfied. This is perhaps the most decisive point of the decision. The Board proceeds from the principle in Article 4 of the Law that data processing must be "relevant to the purpose, limited and proportionate." According to the decision, alternatives exist, such as password-protected cards or PIN-based systems, signature-based and paper-based attendance sheets, RFID/NFC identity cards, or manual entry under a supervisor's oversight. The Board states that the existence of these alternatives shows that processing biometric data is not necessary. Attendance tracking, meanwhile, is described in the text of the decision as a limited administrative purpose.
The conclusion these three findings lead to is also briefly summarized in KVKK's 27 August announcement: biometric data processing carried out solely for attendance tracking does not rest on any of the processing conditions in Article 6 of the Law, and even where valid explicit consent exists, it does not meet the proportionality criterion.
The decision also cites court rulings
The principle decision bases its assessment not only on the text of the Law but also on court rulings. The text cites a 10 March 2022 ruling of the Anayasa Mahkemesi (the Constitutional Court) in an individual application concerning attendance tracking with a fingerprint system. According to the decision, the Constitutional Court held that the right to request the protection of personal data had been violated, on the grounds that the relevant legislation contained no provision setting out the basic principles for biometric tracking systems. The decision also refers to a ruling of the Danıştay (the Council of State) on attendance tracking with a palm-vein reader, as well as to the appeal stage of that ruling.
The exception: areas requiring multi-layered security
KVKK's August announcement contains an important clarification about the scope of the decision. According to the announcement, certain facilities and fields of activity are set apart from the general assessment because of the security risks they carry. In these areas, biometric systems become part of multi-layered security processes such as identity verification, authorization and control of access to critical areas.
However, the announcement makes this exception conditional as well. According to KVKK, even in these areas the processing must be limited to the critical areas and persons where it is necessary, alternative methods must prove insufficient, and the processing must be proportionate to a concrete security need.
The conclusion section of the announcement draws two distinctions:
- For biometric data processing carried out for attendance tracking, data controllers must act in line with the principle decision.
- Biometric data processing activities other than attendance tracking are not assessed within the scope of the principle decision. The data controller must itself assess their lawfulness according to the purpose, the nature of the work and the characteristics of the specific case; in the event of a complaint, the Board will examine each case separately.
The announcement also responds to an objection raised in the requests for opinions. Some submissions argued that data should not count as biometric data if it is stored after being converted into a mathematical code. According to KVKK, storing data after converting it into a code does not remove its character as biometric data.
What happens if the decision is not followed?
According to the text of the decision, the Board counts the points it lists among the administrative and technical measures that data controllers must take under Article 12 of the Law. It states that, if non-compliance with these points is established, action will be taken under Article 18 of the Law. What the concrete sanction will be depends on the assessment of each individual case.
What can companies review?
The steps below are a general framework derived from the source texts; they do not replace a legal assessment.
- Take inventory. List all systems and locations in the organization that process fingerprint, facial recognition, palm or similar biometric data.
- Clarify the purpose. For each system, put in writing whether the primary purpose is attendance tracking or access control for critical areas. According to the KVKK announcement, what is decisive is whether the processing goes beyond the purpose of attendance tracking.
- Plan the alternative. Assess the timeline and impact of moving attendance tracking to the card, PIN, NFC or record-based methods that the decision lists; build in integration with payroll and shift systems from the outset.
- Address the accumulated data. Together with your legal team, plan the process for deleting or destroying the biometric records held in systems that will be retired.
- Update the documents. Check whether privacy notices, explicit-consent forms and the personal data inventory are consistent with the new situation.
Conclusion
Read together, the Board's principle decision no. 2026/921 and KVKK's August announcement send a clear message: according to the sources, processing biometric data solely for attendance tracking is not found proportionate, while the security-focused exception is narrow and conditional.
From Orient Global's perspective, this decision does not have to be seen as a step back for technology. Moving attendance tracking to less intrusive methods, such as card- or PIN-based systems, can also be an opportunity to simplify payroll and shift processes. What matters is to carry out the transition in a planned way, together with the legal team and with the systems and data documented.
Why operations and logistics experience matters here. In warehouses, transport networks and distribution centers, attendance records typically feed shift planning and payroll across many sites and large teams, so changing the method is an operational change as much as a compliance one. One of Orient Global's consultants brings more than 30 years in operations, logistics and supply chain, including managing nationwide warehouse and transport operations and building and leading teams of 100+ people. An industrial engineer, he now brings that operational discipline to SMEs through AI and automation. Meet our consultants.
#interimmanagement #forwarddeployedengineering