Is fingerprint attendance tracking legal in Turkey? KVKK, biometrics and mobile clock-in

The factory’s old turnstile system is due for replacement. The device vendor recommends a fingerprint reader: fast, no card swapping, and an end to buddy punching. The company’s legal counsel says, “Let’s check KVKK first.” Meanwhile, the field team asks whether they can clock in and out from their phones. Three questions arrive at once: is fingerprint attendance tracking legal, is mobile clock-in legal, and is a consent form signed by the employee enough? The short answer to “is a time and attendance system legal?” is “it depends on the method.” Using the text of KVKK, Turkey’s personal data protection law, and the latest principle decision of the Personal Data Protection Board, this article walks through what the answer depends on under Turkish law.

The legality of a time and attendance system in Turkey is a legal assessment that depends less on whether entry and exit records are kept than on which personal data is used and which method captures the record.

Is a time and attendance system legal? Keeping records and choosing the method are separate questions

According to an announcement by Turkey’s Personal Data Protection Authority, employers have an obligation to track and document working hours. The same announcement stresses that there is no explicit legal provision requiring this tracking to be done with biometric identification systems. So keeping attendance records is not in dispute; the dispute is about how the records are captured. This is where the principles in Article 4 of Law No. 6698 come in: data must be relevant, limited and proportionate to the purpose for which it is processed.

Is fingerprint clock-in legal?

Article 6(1) of the Law classifies biometric and genetic data as special categories of personal data. Article 6(3) sets out the basic rule:

Processing of special categories of personal data is prohibited.

The prohibition is lifted if one of the listed conditions applies, such as explicit consent, being expressly provided for by law, or a legal obligation related to employment. In its Principle Decision No. 2026/921 of 29 April 2026, the Board assessed these conditions one by one for working-time tracking. The decision was published in the Official Gazette on 2 June 2026, and its conclusions are, in short:

• The condition of being expressly provided for by law is not met. The legislation refers to tracking working hours but does not provide for doing it biometrically.
• Explicit consent alone was not considered sufficient. The imbalance of power in the employer–employee relationship raises doubts about whether consent is truly voluntary; consent can also be withdrawn.
• Even with valid consent, proportionality is not met. Processing biometric data while less intrusive alternatives exist was found disproportionate.
• Alternatives were listed: encrypted card or PIN-based systems, signature and paper-based attendance sheets, RFID/NFC ID cards, and manual entry under a supervisor’s oversight.

A second announcement by the Authority, dated 27 August 2026, clarifies one more point: converting a fingerprint into a mathematical code and storing it in a database does not remove its status as biometric data. The defence “we don’t store the fingerprint, only its template” therefore offers no solution.

What happens if an employee refuses to give a fingerprint?

The Board’s reasoning rests on exactly this question. The Board states that if employees are not effectively given the option to refuse or withdraw consent, or if refusing could have negative consequences for them, it cannot be said that they have a real choice. So an arrangement of “fingerprints for those who want them, cards for those who don’t” may look reasonable on paper, but on its own it does not provide a legal basis. The real solution is to use a non-biometric method for everyone.

Can a biometric system be installed for security reasons?

The same announcement treats some facilities separately from the general assessment. In multi-layered security processes such as controlling access to critical areas, biometric identification is a security tool, not a working-time tracking tool. Even then, the Authority expects use to be limited to the necessary areas and people, alternatives to be insufficient, and the use to be proportionate to a concrete security need. Each case is assessed separately, so a “fingerprints for everyone in the name of security” approach is not a safe path.

Is mobile clock-in legal? Recording attendance from a phone

Recording attendance on a phone does not by itself create special-category data. What decides the assessment is which data the app collects. A clock-in with a username and password is processing of personal data and is subject to the principles of Article 4. If face recognition or fingerprint verification is added, biometric data is involved and the principle decision above applies. If location is collected, the questions change: is location captured only at clock-in and clock-out, or tracked all day, and do employees know this in advance? We did not base this article on a separate Board principle decision on location data; consult your adviser before setting up such a method.

KVKK consent for attendance tracking: is a signed consent form enough?

For a biometric method, no; as shown above, consent alone was not considered a valid basis. For a non-biometric method, explicit consent may often not even be necessary: Article 5(2) of the Law allows processing without explicit consent if one of several conditions applies, such as performance of a contract, the data controller’s legal obligation or legitimate interest. Which one applies depends on the specific situation. Whichever condition is chosen, Article 10 requires you to inform employees of your identity, the purpose of processing, to whom the data may be transferred, the method of collection, the legal basis and their rights. In practice, the key document for attendance tracking is not a signed “consent” but a clear and understandable privacy notice.

Seven steps to a legally sound attendance system

1. Take inventory of your current method: which device, which data, and who stores it?
2. If you have a biometric reader, plan its removal or a switch to an alternative such as cards or PINs.
3. Give employees a clear privacy notice covering your identity, the purpose, transfers, the collection method and their rights.
4. Restrict access to attendance data by role; a department manager should see only their own team.
5. Set a retention period and define the step for deleting, destroying or anonymising the data when it expires.
6. If your device or software provider accesses your data, set out responsibilities clearly in the contract.
7. Keep access and change logs; document the technical and administrative measures under Article 12.

Is keeping records on paper or in Excel legally safer?

Signature and paper-based sheets are among the alternatives the Board listed, so these methods are not legally controversial. The problem is operational: errors, no trail of retroactive changes, and mismatches with leave records. Paper sheets also carry personal data; who sees them and where they are kept matters.

Where does YazSis KurumsalPortal fit in?

The Time & Attendance Control module is not a device; it brings time-clock records together on one screen, matches them to employees and routes exceptions for approval. How data is transferred from your existing device is agreed during the project. The portal’s role-based data scope, masking of fields such as Turkish ID numbers and IBANs, document access logs and audit logs help you build a KVKK-focused process; however, it does not make the choice of method or the legal assessment for you. To restrict menu and data access by role, see the Menu & Authorization Management page.

If you want to keep attendance data organised, permission-based and traceable regardless of the method, take a look at the module structure on the KurumsalPortal page.