Recent Development
The Turkish Data Protection Board (the “Board“) published a principle decision regarding the processing of biometric data for employee time and attendance tracking purposes.
The principle decision of the Board, dated 29 April 2026 and numbered 2026/921, containing evaluations on the processing of biometric data within the scope of time and attendance tracking (the “Principle Decision”), was published in the Official Gazette No. 33269 dated 2 June 2026. The Board concluded that carrying out time and attendance tracking of employees through biometric identification systems constitutes unlawful processing, as it lacks a clear legal basis and does not comply with the legal grounds and general principles set forth under the Personal Data Protection Law No. 6698 (“Law”).
The Principle Decision is available here (in Turkish).
Details of the Principle Decision
- In the context of the digitalization of time and attendance tracking, the Board stated that it has carried out examinations based on notifications and complaints regarding employers’ use of biometric identification systems, such as fingerprint, facial recognition, iris, and retina scans, and concluded that such practices should be assessed in light of the provisions and fundamental principles of the Law.
- The Board emphasized that, pursuant to the Labour Law No. 4857 and the relevant legislation, employers are obliged to monitor and record working hours, however, there is no explicit legal provision requiring this obligation to be fulfilled using biometric data. Accordingly, the Board stated that the processing of biometric data for time and attendance tracking purposes cannot be based on the legal ground of being “explicitly stipulated by laws” under Article 6 of the Law.
- The Board highlighted that, in practice, biometric data processing activities are often based on explicit consent, however, due to the inherent imbalance of power in the employer-employee relationship, explicit consent cannot be deemed to have been given freely, in all cases. In this context and by also considering that explicit consent can be withdrawn at any time, the Board assessed that explicit consent alone does not constitute a valid legal basis.
- The Board further stated that personal data processing activities must, in all cases, be carried out in compliance with the general principles set out under Article 4 of the Law, and emphasized that it is necessary to conduct an assessment in terms of the principles of (i) proportionality, (ii) necessity, and (iii) data minimization. In this regard, the Board concluded that, even where explicit consent is obtained, the processing of biometric data for time and attendance tracking purposes would not satisfy the proportionality requirement under Article 4 of the Law, as there are less intrusive alternative methods for this purpose.
In this regard, the Board decided that employers should resort to alternative and less intrusive methods for time and attendance tracking, such as password-protected cards, PIN-based systems, traditional signature sheets, or manual recording under the supervision of an auditor, instead of biometric identification systems.
In light of the above evaluations, the Board decided that, where it is determined that data controllers fail to comply with the administrative and technical measures required to ensure the lawful processing of personal data pursuant to Article 12 of the Law, administrative fines shall be imposed on the relevant data controllers in accordance with Article 18 of the Law.
Conclusion
With this Principle Decision, the Board establishes that practices involving the processing of biometric data for time and attendance tracking purposes would be deemed contrary to the Law, and that employee attendance can instead be monitored through alternative methods such as password-protected cards, PIN-based systems, traditional signature sheets, or manual recording under the supervision of an auditor. In this context, employers are required to review their existing time and attendance tracking practices and systems in line with the evaluations set out in the Principle Decision. In addition, the Board’s assessments regarding the validity of consent-based data processing activities, particularly within the framework of the employer-employee relationship, are of significance for all employers. The Principle Decision will thus have significant practical implications for employers in terms of their management rights, particularly regarding the tracking and verification of working hours and workplace order.
