Biometric Attendance and Data Protection in Türkiye: What Decision 2026/921 Means for Employers
Is biometric attendance lawful in Türkiye? We explain KVKK Principle Decision 2026/921, employer duties and a step-by-step move to card-based attendance.
Phone: 0 (552) 380 25 25 | Weekdays 10:00–18:00 · Technical support 24/7
Fingerprint access control is a biometric system that opens doors with a fingerprint instead of a card, letting only authorised people through. Because Turkey's data protection board (KVKK decision 2026/921) treats biometric time attendance as unlawful as a rule, we recommend it for critical areas such as server rooms and labs, and card-based systems for attendance.
Cards get forgotten, lost or handed to a colleague, so the person entering a critical room may not be the cardholder at all. With a fingerprint reader, only the enrolled person can pass, and you no longer have to print cards, cancel lost ones and issue replacements.
It pays off most where access must be tied to an individual: stores, laboratories and server rooms. Fingerprints are special-category personal data under Turkey's data protection law (KVKK). According to the board's announcement of 2 June 2026 (in Turkish), processing biometric data for time attendance fails the proportionality test even with explicit consent, and attendance should be recorded with cards, PINs or RFID/NFC ID cards instead. We therefore plan a set-up that limits fingerprints to critical-area access, together with the privacy notice, as part of the installation, and can support you through our data protection compliance service.
The employee places a finger, the device matches it against the enrolled template and opens the door. The false accept/reject balance is tuned to each area's security needs.
Nobody can enter a critical area on a colleague's card, so the access log shows who actually walked through the door.
If the network drops, the device keeps controlling the door from local records and uploads events once the connection returns.
For critical doors, require both fingerprint and card for two-step verification.
A fingerprint-based access system was deployed at a 3-shift production plant to prevent attendance fraud. All employees were enrolled in the management software; door transits and attendance data flowed automatically into the payroll system. After go-live, attendance disputes and conflicting entry records disappeared. Since KVKK decision 2026/921, time attendance should use a card-based system rather than this method. For card-based options, see our card access control page; to combine access, time attendance and canteen counting in a single card tap, take a look at SmartPass.
Under the Turkish data protection board's principle decision 2026/921 of 29 April 2026, processing biometric data for time attendance fails the proportionality test even with explicit consent and is unlawful as a rule. The board says attendance should be recorded with cards, PINs or RFID/NFC ID cards instead, so we recommend card-based systems for attendance.
In critical areas where access must be tied to an individual, such as server rooms, laboratories and stores. Cards can be forgotten, lost or lent, while a fingerprint lets only the enrolled person through. The board's guidance also notes that biometrics may be used for critical-area access control where necessary and proportionate.
Yes. If the network goes down, the device keeps controlling the door from its local records and uploads events once the connection returns. Models with a built-in battery keep working through power cuts. Readers connect over TCP/IP or RS-485, and a Wiegand output lets them join existing door control panels.
Yes. In hybrid mode, critical doors can require both fingerprint and card for two-step verification, and readers are available with an optional RFID card reader. For time attendance and canteen counting, the card-based SmartPass system combines access, attendance and meal records in a single card tap.
Fingerprints are special-category personal data under KVKK, requiring purpose limitation, proportionality and strong technical safeguards. During installation we plan a set-up that limits fingerprints to critical-area access, together with the privacy notice process. Where needed, our data protection compliance service can support the wider compliance process.
Have a different question? Ask Us