CCTV recording and KVKK are linked because footage of an identifiable person is personal data under Türkiye's data protection law, Law No. 6698 (KVKK). Workplace cameras are lawful, but each needs a clear purpose, people must be informed, access must be restricted, footage should be deleted automatically as early as possible and audio should not be recorded without justification.
The camera system grew; the compliance file did not
Most camera systems grow piecemeal: two cameras at the gatehouse, four in the warehouse, a few on the production line after a theft. The recorder sits in a cupboard, its admin password has not changed in years and nobody is quite sure how many days of footage it keeps.
The compliance file stays as it was on day one. There is a "CCTV in operation" sticker on the door but no privacy notice, or one that covers half the cameras. Camera locations, which units pick up sound and who can see the monitoring screen appear in no inventory; when the personal data inventory is drawn up, the camera system is often simply forgotten.
The gap surfaces when an employee complains or footage is requested after an accident. Why is this camera here, did people know, and who watched this footage? Without written answers, the employer is in a weak position. How to deal with an employee or visitor asking for their own footage is covered in handling data subject requests.
What KVKK requires for CCTV
KVKK is Türkiye's general data protection law, broadly comparable to the GDPR, enforced by the Personal Data Protection Authority and its decision-making Board. On 8 June 2026 the Authority issued a public announcement dedicated to security cameras in workplaces (KVKK, public announcement on the use of security camera systems in workplaces). Its core can be summarised in five points:
- Define the purpose. Workplace security, preventing and detecting crime, or occupational health and safety are examples; cameras should not be used for other purposes such as tracking attendance or performance.
- General oversight is not a legitimate purpose. Checking whether staff are working productively, tightening discipline or maintaining general control does not qualify.
- Audio needs its own justification. Audio-capable cameras must be assessed for proportionality and must not be used unless a lawful reason and necessity are clearly established.
- Keep footage for the shortest possible time. Recordings should be retained only as long as the purpose requires, with an automatic deletion mechanism in place.
- Restrict access and inform people. Only authorised staff should reach recordings, and under Article 10 of the law people must be told that the area is being recorded.
These principles are not new, and they are enforced. In decision 2023/2007, the Board ruled that an employer had no legitimate interest in recording audio through a workplace security camera, since video alone was sufficient for security. The employer was fined and ordered to destroy the audio recordings.
Facial recognition raises the stakes: a facial template is biometric data, a special category of personal data subject to much stricter conditions. We covered the same logic for fingerprint-based attendance in our guide to biometric attendance and data protection.
What a non-compliant camera system costs
CCTV is processing that employees see directly, so it tends to attract complaints, and complaints are an increasingly used route (up from 9,059 in 2024). According to the KVKK 2025 Annual Activity Report, the Authority received 12,512 complaints and reports in 2025, and the Board took 2,528 decisions across 42 meetings that year. The same report shows 328 data breach notifications in 2025.
Security is also where businesses most often put connected devices to work. European data shows premises security is the most common use among enterprises that use IoT:
Eurostat reports that in 2021, 29% of EU enterprises with 10 or more employees used IoT devices or systems, and 72% of these used cameras and similar devices to secure their premises. (Eurostat, Use of Internet of Things in enterprises)
Beyond fines, destroying unlawful audio, repositioning cameras, rewriting notices and repairing staff trust all cost time and money. And if a recorder with a default password, exposed to the internet, lets outsiders watch footage, the issue becomes a data breach notification within 72 hours.
An eight-step framework for CCTV recording and KVKK compliance
The same order works for new and long-running systems:
- Build a camera inventory. List every camera with its location, field of view, whether it records sound, the recorder it feeds and its retention period. Treat this list as part of your personal data inventory and keep it consistent with any VERBIS registration, Türkiye's data controller registry.
- Write down a purpose for each camera. Use concrete purposes such as "Gatehouse: entry and exit security" or "Forklift aisle: safety incident review". A camera whose purpose you cannot write down should be removed or redirected.
- Keep private areas out of view. Toilets, changing rooms, showers and prayer rooms, where people expect privacy, must stay outside the field of view; in rest areas, question whether a camera is needed at all. Use privacy masking (blacking out part of the image) where an angle cannot be avoided.
- Switch audio off by default. Identify cameras that record sound and disable the feature. If audio is genuinely needed, document the justification in a written proportionality assessment.
- Use layered notices. Place a sign visible before people enter the recorded area, stating who records, why and where the details are, and link it to a full privacy notice. Give employees the same information when they join. For security cameras the duty is usually notice rather than explicit consent; we explain the difference in explicit consent vs privacy notice and the wider staff picture in employee personal data under KVKK.
- Set a retention period and automate it. The purpose sets the period; the law does not specify a number of days. Record your chosen period and the reasoning in your data retention and disposal policy, then enforce it through the recorder's overwrite cycle.
- Restrict access by role and log it. Assign live viewing, playback and export rights to different people. Log who viewed or exported which footage and when, and document any export for an incident in a written record.
- Close the technical gaps. Change default passwords, separate the camera network from the office network, keep the recorder off the open internet and apply firmware updates. For remote viewing use encrypted connections and multi-factor authentication; the wider basics are in our SME cyber security checklist.
How common purposes are generally assessed (your specific circumstances decide the final answer):
| Purpose | General assessment | What to watch |
|---|---|---|
| Building and site security, theft prevention | Can be a legitimate purpose | Purpose documented, notice in place |
| Workplace accident and safety incident review | Can be a legitimate purpose | Footage opened only for incident review |
| Employee productivity and discipline | Not a legitimate purpose per the 2026 announcement | Do not use cameras for this |
| Attendance and working hours | Not a suitable purpose for cameras | Use a separate system such as card-based time and attendance |
| Audio recording | Not without a clearly established justification | Board decision 2023/2007 found it unlawful |
| Facial recognition | Biometric, special category data | Very strict conditions; unnecessary for most businesses |
Do not turn cameras into tools for other jobs
The most common way cameras drift from their purpose is attendance tracking. If "who arrived when" is answered from CCTV, the use conflicts with the Authority's announcement and the process cannot be measured properly. The right tool for attendance is a card or QR-based time and attendance system; cameras stay with security.
Vehicle entry is similar: a plate reader that opens a barrier serves a different purpose from an area camera, so define them separately. We explain how to treat plate data in our licence plate recognition guide.
Carefully designed video analytics can fit a legitimate purpose, for example flagging a missing hard hat without identifying the person, as described in our article on AI-based PPE detection.
How we handle CCTV and KVKK compliance at Digital Bridge
One team handles both the installation and the data protection side:
- Discovery and needs analysis. We walk the site to identify existing cameras, recorders, network layout and audio-capable devices. We write a purpose for each camera with you and report those without one.
- Compliance documentation. Through our data protection compliance consultancy we prepare the camera inventory, layered notices, the retention rationale and an access rights matrix, and put access logging and automatic deletion of expired footage into the systems themselves.
- Pilot area. We start with one area, such as the gatehouse and warehouse, applying masking, audio shut-off, the retention cycle and role-based access, then gather feedback from staff and the security team.
- Central management and integration. We bring mixed-brand cameras together over ONVIF and set up IP camera monitoring with role-based access, so each user sees only the cameras and sites they are authorised for. Our guide to central IP camera management with ONVIF covers how scattered systems are consolidated.
- Security hardening. On the cyber security side we segment the camera network, put remote access behind encryption and authentication, and remove default credentials.
Where analytics are needed, we design computer vision models that flag only purpose-relevant events without identifying individuals. We also take attendance off the cameras altogether: our own product SmartPass opens the door and records attendance with a single card read, never stores card numbers in plain text and anonymises records once their retention period expires.
If you plan to use cameras for something other than security, such as measuring footfall, our guide to a retail people counting system describes a design that produces counts without storing footage.
Next step
One list is enough to start: write down every camera on site with its location, purpose, audio capability and retention period. Any camera whose purpose you cannot state in one sentence is the first one to deal with. Bring that list to us via our contact page and we will complete the inventory with you during a site visit and prioritise the gaps. For more guides on security and data protection, visit our Cyber Security & Compliance hub.