Cybersecurity Policy Report, Turkish DPA Outlines Requirements for Biometrics in Employee Tracking, (Jun 2, 2026)
By Tony Foley
The Turkish data protection authority (KVKK) published an announcement today regarding an April decision on the processing of biometric data for the purpose of tracking employee attendance.
The announcement noted that, while biometric systems were attractive tools due to their speed, accuracy, and resistance to manipulation, they nevertheless constituted an extremely sensitive area within the context of personal data protection law. KVKK said the structural power imbalance existing in employer-employee relations raised serious doubts about whether explicit consent was based on free will, adding that biometric data processing activities must comply not only with legal grounds but also with the principles of proportionality, necessity, and data minimization.
The decision focused on the following issues:
Turkish law requires the monitoring of working hours but does not state explicitly how the monitoring should be conducted or whether the processing of biometric data is required, meaning that a basis for processing based on a legal requirement cannot be accepted;
Since none of the processing conditions under Turkish data protection law outside of consent are applicable to biometric processing activities in the context of tracking worker hours, explicit employee consent is the preferred basis;
Due to the power imbalance between employers and employees, however, there is doubt as to whether explicit consent is based on free will, and accordingly, does not constitute a sufficient legal basis on its own; and
Given the existence of alternative, less intrusive methods, processing of biometric data for attendance tracking does not meet the law’s proportionality requirement, even where explicit consent is obtained.
The KVKK concluded that working hour tracking should be provided through alternative methods like encrypted card or PIN-based systems, traditional signature and paper-based attendance sheets, RFID/NFC ID cards, or manual entry under the supervision of an auditor, instead of biometric identification systems.
News: InternationalLegislation DataPrivacy