Employee data protection in Turkey is governed by KVKK (Law No. 6698) and covers everything an employer holds about staff, from CVs and personnel files to payroll, health reports, attendance logs, email and CCTV footage. Employers need a lawful ground, advance notice to staff, role-limited access and a defined retention period. Consent is rarely the right basis.
Why employee data protection in Turkey is hard to get right
KVKK is Turkey's general data protection law, broadly modelled on EU rules and comparable to the GDPR, and is enforced by the Personal Data Protection Authority and its Board. It shares the GDPR's core ideas (lawful grounds, transparency, purpose limitation, retention limits, security) but has its own list of legal grounds and a national register of data controllers called VERBİS. If you employ people in Turkey, your HR data falls squarely within it.
The difficulty is that employee data never sits in one place. A CV lands in a recruiter's inbox, identity documents and criminal record certificates go into the personnel file, the pre-employment medical creates health data, and then attendance logs, payroll, leave forms, training records, email and camera footage accumulate. HR, finance, IT, the occupational physician and site security each hold a piece. For mandatory training records, see digital tracking of OHS training records.
In most companies nobody can answer a simple question: who holds which employee data, for what purpose and for how long? This article applies the general KVKK compliance roadmap to that question.
What poor handling of staff data costs
Employees see their employer's data practices more closely than any other data subject, so a problem they notice can quickly become a request or a complaint. The Authority's own figures show where problems cluster:
Of the 12,512 notices and complaints the Turkish data protection authority received in 2025, 6,506 concerned unlawful processing by data controllers and 2,838 (22%) concerned unlawful sharing with third parties; human resources appeared as a sector in its own right with 244 complaints. (KVKK 2025 Annual Activity Report)
Third-party sharing is familiar territory for HR teams: answering a reference request too generously, emailing an unencrypted payroll export, or passing a staff list to a supplier. The technical risk is human too. The Verizon 2026 Data Breach Investigations Report found the human element in 62% of breaches, and a payslip sent to the wrong address is exactly that kind of incident, one that can trigger the 72-hour breach notification duty.
Monitoring is a separate exposure. The Authority's 8 June 2026 announcement on workplace security cameras states plainly that checking whether employees work efficiently or tightening discipline is not a legitimate purpose. The same reasoning carries over to email, location and endpoint monitoring: if the purpose is vague, the legal footing is weak, however common the tool. Logs of the internet access you provide to staff fall under a separate legal duty, which we cover in Law 5651 log retention.
Lawful grounds for processing employee data in Turkey
Article 5 of Law No. 6698 on the Protection of Personal Data lists a closed set of conditions. For employee data the relevant ones are usually: performance of the employment contract, compliance with a legal obligation (labour, social security, tax, and occupational health and safety rules), processing expressly provided for by law, and the employer's legitimate interests provided they do not harm the employee's fundamental rights. Separately, Article 75 of the Turkish Labour Law requires employers to keep a personnel file for every worker and to use that information in good faith.
Explicit consent, by contrast, is a fragile basis in employment because of the imbalance of power. The Board made this point directly in its ruling on biometric attendance systems. Asking for consent to something that already rests on another ground gives staff the impression they can refuse, when in fact the processing will continue without it, and leaves open what happens if consent is withdrawn. Keep the privacy notice and any consent form as separate documents.
Health data, trade union membership, criminal records and biometrics are special category data under Article 6. Amendments made by Law No. 7499, in force since 1 June 2024, added a specific condition: processing necessary to meet legal obligations in employment, occupational health and safety, social security, social services and social assistance. That is not a licence to circulate medical details; the pre-employment medical should stay with the occupational physician, and HR should receive only the fit-for-work outcome.
A map of employee data: category, basis and access
The table below summarises the data groups we meet most often and the question to ask about each. Retention periods depend on your own legal analysis and your retention and disposal policy, so they are deliberately left out.
| Data group | Typical lawful ground | Who should have access | Common mistake |
|---|---|---|---|
| Candidate CVs and interview notes | Steps prior to entering a contract | Recruitment team | Rejected candidates' CVs sitting in mailboxes for years |
| Personnel file (ID, address, education, criminal record) | Legal obligation, contract performance | HR | File stored in a shared folder open to everyone |
| Payroll, bank and social security details | Legal obligation, contract performance | HR and payroll officer | Payslips sent unencrypted or as a combined list |
| Medical reports and fitness outcomes | Employment and OHS obligations (special category) | Occupational physician | Reports filed alongside general HR documents |
| Attendance and access-control logs | Contract performance, legitimate interest | HR, line manager | Logs kept indefinitely; use of biometrics |
| Business email and files | Legitimate interest (with prior notice) | Rule-based, logged access | Leavers' mailboxes left open without control |
| CCTV and location data | Legitimate interest (limited to security) | Security lead | Footage drifting into performance tracking |
An eight-step plan from hiring to offboarding
Employee data compliance is not a one-off document. The sequence below works for a small HR team as well as a large one.
- Build an inventory: list which data about candidates, employees, interns and former staff sits in which system; our guide to building a KVKK personal data inventory sets out the method. Keep it consistent with your VERBİS registration, the controllers' register many Turkish employers must file.
- Record a lawful ground for each activity: document the condition and purpose for every data group, as in the table. Challenge anything currently resting on consent.
- Give notice at the right moment: provide a privacy notice to candidates when they apply and to employees on joining. Name the monitoring tools (CCTV, email, attendance) and keep a signed or electronic acknowledgement.
- Separate special category data: store health and criminal record documents in a restricted area. Limit what anyone other than the occupational physician sees to the outcome.
- Tie access to roles: HR sees the personnel file, line managers see attendance, the payroll officer sees pay. Grant rights to roles rather than individuals and log who viewed what.
- Put sharing under rules: sign written data processing agreements with payroll bureaus, external OHS providers, insurers and software vendors. Decide who answers reference and information requests, and within what limits.
- Enforce retention in the system: set periods for rejected applications, access logs and former-employee data, and have expired records deleted or anonymised by a scheduled job rather than by hand.
- Run offboarding from a checklist: cards, email, files and applications should close on the same day, and device returns should be recorded in a signed handover. Our guide to offboarding email access covers mailboxes, forwarding rules and shared links in detail. Also decide in advance who will answer data subject requests from former staff.
Not all of this is legal work. A lawyer drafts the privacy notice, but unless role-based access, scheduled deletion and same-day revocation are configured in software, the policy stays on paper. The baseline technical controls are summarised in our SME cyber security checklist.
How we handle employee data projects at Digital Bridge
We start with a discovery session involving HR, IT and, where there is one, the occupational physician, to trace where employee data is created, which systems it moves between and who can reach it. Under our data protection compliance consultancy, the outputs are an inventory, a lawful-ground table and an access matrix. We work alongside your own legal adviser on the formal texts.
Next we close the technical gaps. Typical work includes moving personnel documents out of shared drives into a permissioned document management system, removing the spreadsheet step between attendance and payroll, and setting up role-based access in HR, payroll and personnel management software. How attendance data should flow into payroll is covered in our article on attendance and payroll integration; if you are assessing a new system, add the data protection questions from our HR software selection guide to your list.
For organisations that want personnel and health documents in our own product, SmartFiles business file management gives HR a separate storage area: rights such as read, write and delete are granted separately to individuals or departments, folders can carry a retention period, and readable documents are scanned for values such as national ID numbers and IBANs and for possible special category terms. On the leaving date, the single panel of the Smart360 product family closes an employee's email, file and access-control rights in one place, however many products they used.
The third strand is security and monitoring. Our cyber security work looks at who can open HR folders, how payslips are sent and what rules govern CCTV and email monitoring; for cameras we apply the framework in our CCTV recording and KVKK guide. We do not sell off-the-shelf packages: after the needs analysis, scope, phases and fees are set out in a written proposal.
SmartPass: building KVKK rules into attendance and access data
Entry and exit logs are the fastest-growing part of any employee dataset. SmartPass combines card-based access control, time and attendance and canteen meal counting in one system. Because it runs on 13.56 MHz MIFARE and NFC-readable cards and reads only the card's ID number (UID), you do not need biometric data to track working hours, and there is no separate attendance device: timesheets follow the shift plan, the closed month is locked and a per-person monthly summary goes to the ERP as CSV or JSON.
Data protection sits in the core design. SmartPass does not store card numbers: at the moment of reading, each number is turned into a one-way hash with a key unique to the organisation, and the database holds only the hash and the last four digits. The organisation chooses how long access records are kept; once that period ends, the fields that link records to a person are deleted automatically every day, while counts and reports are preserved. Every change is kept in the audit log with its previous and new value, and panel access is limited through 43 separate permissions, so someone can be allowed, for example, only to view timesheets or only to receive visitors.
A concrete scenario: in a manufacturer with three sites, each site is opened as a separate SmartPass organisation and each organisation's data is kept in its own database, so records from different sites never share a table. When someone leaves, their card is cancelled; once the retention period ends, the leaver's name, contact details and photo are deleted, while counts and reports remain. Because the audit log report requires a separate permission, only the person given that permission reviews the process.
Next step
Start small: on one page, list the folders, mailboxes and devices where candidate, current-employee and former-employee data lives. Then get in touch and we will help you prioritise the access and retention gaps, and show how SmartPass would fit your access and attendance setup if that is relevant. For related topics, see our Cyber Security & Compliance guide.