On biometric attendance and data protection in Türkiye, the position is now clear. Under Principle Decision 2026/921 of 29 April 2026, the Personal Data Protection Board holds that processing fingerprints, facial images or iris scans to track working time fails the proportionality test even when employees have given explicit consent. Attendance should be tracked with cards, PINs or RFID/NFC ID cards instead.
The Board has also said it will act under Article 18 of the law against data controllers that do not comply. Employers still running fingerprint terminals need a plan to move to cards and to delete the biometric data they already hold.
This article is not legal advice. It sets out what the decision says, the practical steps in front of an employer and the technical side of the switch; we recommend reviewing your own situation with a legal adviser. More guides on cards, attendance and access control are in our access control and attendance hub.
Why biometric attendance became so common
In time and attendance systems, fingerprint clocks were sold for years as the definitive answer to "buddy punching", where one employee clocks in for another. A finger cannot be forgotten or lent, and the terminals are easy to install. Walk into many factories, construction sites and shops in Türkiye today and you will still find a fingerprint terminal on the wall and a signed consent form in the personnel file. On site, these devices also fail regularly on dry, worn or dirty fingers; we explain why in fingerprint reader not recognising fingerprints.
The weak point was the legal basis. Türkiye's data protection law, KVKK (Law No. 6698 on the Protection of Personal Data, broadly modelled on EU rules and comparable to the GDPR), lists biometric data among the special categories of personal data in Article 6 (KVKK, Law No. 6698, Article 6). Such data may only be processed under a short list of conditions and requires additional security measures set by the Board. In practice, most employers relied on a single basis: the employee's explicit consent. Yet biometrics are the most sensitive item in an organisation's wider KVKK compliance programme: without the inventory, privacy notice, retention period and security measures designed together, a consent form cannot carry that weight.
Biometric attendance and data protection: what Decision 2026/921 says
In a public announcement on 2 June 2026, the Personal Data Protection Authority said biometric attendance tracking was one of the issues it met most often in complaints. Its reasoning rests on three points:
- No explicit statutory basis. Employment law requires employers to record working hours, but it does not require or foresee doing so biometrically. The "explicitly provided by law" condition therefore cannot be relied on.
- Consent alone is not enough. Because of the power imbalance between employer and employee, consent given where refusing might have negative consequences cannot be considered freely given. The fact that consent can be withdrawn at any time also undermines the continuity of the system.
- It is disproportionate. Where less intrusive alternatives exist, using biometrics conflicts with the general principles in Article 4 of the law.
According to the Board, attendance should be tracked not by biometric identification systems but by "alternative means such as encrypted card or PIN-based systems, traditional signature and paper-based attendance sheets, RFID/NFC ID cards, or manual entry under supervision". (KVKK, public announcement on Principle Decision 2026/921)
The decision explicitly covers face recognition and iris scanning as well, so swapping fingerprint readers for face terminals does not solve the problem.
A common defence heard on site is that "the terminal only stores a mathematical template, not the fingerprint image". A template exists precisely to identify an individual uniquely; it is the biometric system. Since the Board has found the method itself disproportionate, the storage format does not create a legal basis on its own. Nor does the fact that a device works "only locally" mean no processing is taking place.
The cost of doing nothing
Complaints to the regulator are rising quickly. According to the KVKK 2025 Annual Report, complaints and reports rose from 9,059 in 2024 to 12,512 in 2025; the Board took 2,528 decisions across 42 meetings that year and imposed administrative fines on 876 data controllers. A fingerprint clock is a visible practice that a single employee complaint can bring under review.
The European experience points the same way. In 2020 the Dutch data protection authority fined a company €725,000 for scanning employees' fingerprints for time and attendance, finding neither valid explicit consent nor any other exception (Biometric Update, report on the Dutch fingerprint attendance fine). The Turkish principle decision follows similar logic, which matters for international groups applying one attendance policy across EU and Turkish sites.
Fines are not the only cost. If biometric data leaks, it cannot be reissued like a card; a breach notification to the Board within 72 hours, communication with employees and reputational damage follow together. And if timesheet data from a biometric terminal is argued to have been obtained unlawfully, the employer's records in overtime or absence disputes may themselves come under challenge.
Moving from fingerprint attendance to cards: seven steps
The switch is more than unscrewing one terminal and fitting a card reader. Data, documents and process need to move together.
- Build an inventory. Which sites and how many terminals process biometric data? Are templates stored on the device, on a server or in a supplier's cloud? Include contractor and intern records.
- Stop new biometric enrolment. Put new joiners straight onto the card method rather than growing the old dataset.
- Choose the alternative. For most organisations a card access control system with 13.56 MHz RFID cards is the most practical option, with time-limited QR codes for visitors and contractors. We explain card technologies in our 125 kHz vs 13.56 MHz comparison.
- Align the switch with the payroll cycle. Change over at the start of a pay period so timesheets are not fed from two sources mid-period, and keep any parallel running short.
- Plan and document deletion of biometric data. Templates on devices and servers should be deleted in line with your retention and destruction policy, and the deletion recorded in writing.
- Update your documents. Revise the privacy notice, the personal data inventory and your entry in VERBIS, Türkiye's mandatory Data Controllers' Registry, and withdraw consent forms that are no longer used.
- Tell employees. A short notice on what changed, why, and that old data has been deleted also builds trust.
What about high-security areas?
The principle decision concerns attendance tracking. If biometrics are being considered for physical entry to a server room, a pharmaceutical store or a laboratory, that is a separate purpose: its legal basis, its necessity, and why a less intrusive option such as card + PIN is not enough must be assessed and documented on their own. For a small number of such doors, a card can be combined with fingerprint access, but data from those doors should not be used for attendance. For a full comparison of methods, see our article on fingerprint vs card vs face recognition.
How Digital Bridge helps with the transition
We treat the move away from biometric attendance as both a compliance project and a technical one:
- Compliance. Through our data protection compliance consultancy we review the current processing, privacy notices, retention and destruction policy and VERBIS entry, and plan how deletion of biometric templates will be documented.
- Survey and design. We inspect terminals, doors and turnstiles at each site and establish whether existing turnstiles and locks can be kept.
- Installation. We install card access control for general entry and attendance, and schedule the switch around your payroll cycle.
- Integration. We connect timesheet output to your HR and payroll software through our HR, payroll and personnel management work.
After the needs analysis you receive a written proposal setting out scope, phases and cost. We work across every province of Türkiye, remotely and on site, with technical support available around the clock. If you are choosing new attendance software, the ten questions in choosing time and attendance software will help you avoid repeating the same mistake.
SmartPass: attendance, doors and canteen without biometrics
Our own product, SmartPass, works with the method the Board points to, RFID cards, and collects no biometric data. On a production site moving off fingerprint clocks, a day looks like this:
An employee presents a 13.56 MHz card at the gate turnstile in the morning. In a single read the turnstile opens, an attendance record is created and the timesheet runs against the shift plan, with no separate attendance device. At lunch the same card deducts the day's meal allowance in the canteen if one is due. A contractor crew arriving on site also enters by card; when the contractor's agreement ends there is no need to cancel cards one by one, as the first read is refused as "outside the company contract".
The features that matter for data protection:
- Card numbers are not stored; each is turned into a one-way hash on the device the moment it is read, using a key unique to your organisation, and reports show only the last four digits.
- Records past their retention period automatically lose the fields that identify a person, every day; departing employees' names, contact details and photos are deleted too, while counts and reports are kept.
- Audit log: every change is recorded with its previous and new values; access and audit records are hash-chained, so a deletion or alteration shows up when the chain is verified.
- 43 separate panel permissions, so you can grant, for example, only timesheet viewing or only canteen reports.
- Reports can be exported to payroll, with timesheets calculated against the shift plan.
- Erasure in one place: deleting a person on the Smart360 product family side removes their name and personal details from SmartPass and cancels their card, while the counts remain.
Next step
Write down how many sites and biometric terminals you run and where the templates are stored. With that list, get in touch and we will plan the changeover timetable and deletion steps with you, and show how SmartPass fits your shift pattern.