Personnel files under KVKK in Turkey: who can access them, how to protect ID and IBAN

A team leader asks an employee for their IBAN over WhatsApp so an advance can be paid. Another manager asks, “Can I look at my team’s files?” An employee wonders, “What is in my file, and who has seen it?” All three questions lead to the same place: in Turkey, a personnel file is not just a folder of paperwork but a filing system that holds personal data, and its rules are set out in KVKK, Turkey’s personal data protection law (Law No. 6698). Based on Turkish law, this article explains step by step which data a personnel file contains, when consent is not needed, who may access what and how to protect sensitive fields.

The KVKK obligation for personnel files in Turkey means that the employer processes the employee’s identity, contact, pay and health data lawfully, informs the employee and prevents unauthorised access to the data (Law No. 6698, Art. 4, Art. 10 and Art. 12).

What personal data does a personnel file contain?

KVKK consent for personnel files: is explicit consent required?

The law starts from this point: personal data may not be processed without the data subject’s explicit consent. The same article, however, allows processing without explicit consent if one of certain conditions applies. In an employment relationship, the most relevant ones are (Art. 5):

• It is expressly provided for by law.
• Processing the data of the parties to a contract is necessary, provided it is directly related to the conclusion or performance of that contract.
• It is necessary for the data controller to fulfil its legal obligation.
• It is necessary to establish, exercise or protect a right.
• It is necessary for the data controller’s legitimate interests, provided this does not harm the data subject’s fundamental rights and freedoms.

So instead of having employees sign a blanket “KVKK consent” for every document, a sounder approach is to determine which condition each data group relies on. The rule is stricter for special category data: processing it is prohibited, but possible if one of the listed conditions applies. These include cases where processing is necessary to fulfil legal obligations in employment, occupational health and safety and social security, and the adequate measures determined by the Personal Data Protection Board must also be taken (Art. 6).

Even when consent is not required, informing the employee is always required. When the data is obtained, the employer informs the employee about the following (Art. 10):

• The identity of the data controller and of its representative, if any.
• The purpose for which the data will be processed.
• To whom and for what purpose the data may be transferred.
• The method of collecting the data and its legal basis.
• The employee’s rights listed in Art. 11.

Who may access a personnel file?

The law does not give an access list. As a principle, it requires data to be relevant, limited and proportionate to the purpose of processing (Art. 4) and unauthorised access to be prevented (Art. 12). The Turkish Labour Law No. 4857 also requires the employer to use the information it obtains about the employee in line with good faith and the law, and not to disclose information the employee has a legitimate interest in keeping confidential (Art. 75). Everyone who accesses the data has a duty of confidentiality, which continues after they leave the role (KVKK Art. 12).

The table below is not a rule from the law but a sample access proposal based on the principle of proportionality. Adapt it to your own organisation.

How do you protect an employee’s Turkish ID number and IBAN?

The Turkish ID number and the IBAN are not on the list of special category data in KVKK Art. 6. They are personal data, however, and the data controller must take the technical and administrative measures needed to prevent their unlawful processing, unauthorised access and loss (Art. 12). The law provides for administrative fines for those who fail to meet data security obligations (Art. 18); because the amounts are updated, check the current figure in the announcements of Turkey’s Personal Data Protection Authority.

• Mask Turkish ID numbers and IBANs on screens and in lists; show the full value only where it is needed.
• Tie access to roles and log every document access.
• Prohibit asking for Turkish ID numbers and IBANs over WhatsApp or e-mail; define a secure channel instead.
• Do not put Turkish ID numbers in file names.
• Check regularly who can see these fields in shared folders and printouts.
• Appoint a person responsible for notifying the data subject and the Board as soon as possible if the data is obtained by others unlawfully (Art. 12).

What happens if an employee asks about their data or wants it erased?

Under KVKK Art. 11, anyone may apply to the data controller to learn whether their personal data is processed and, if so, to obtain information about it, the purpose of processing and the third parties it was transferred to; they may also ask for incomplete or inaccurate data to be corrected. For a request for erasure or destruction, if all the conditions for processing have ceased to exist, the data controller concludes the request within thirty days at the latest and informs the data subject; if the conditions still exist, it may refuse the request and explain why (Turkish Regulation on the Erasure, Destruction or Anonymisation of Personal Data, Art. 12). For personnel documents whose statutory retention period is still running, that period is the reason for refusal.

KVKK checklist for personnel files

1. List the data groups you keep in personnel files in a written inventory.
2. Determine the legal basis of each data group: law, contract, legal obligation, legitimate interest or explicit consent.
3. Give employees the privacy notice when they start and record that it was given.
4. Assign special category data (health, criminal record, trade union membership) to a separate, narrower permission group.
5. Prepare a role-based access matrix and review it at least once a year.
6. Set masking and channel rules for fields such as Turkish ID numbers and IBANs.
7. Set out retention and destruction periods in a written policy.
8. Write down who notifies whom, and within what time, in the event of a data breach.

Where do paper files and shared folders leave personnel data exposed?

Even a locked cabinet is open to anyone who has the key, and nobody knows who looked at what and when. In a shared folder, a medical report, a payslip and an IBAN declaration can sit in the same directory, and anyone who opens the folder sees all of them. The problem is not well-meaning employees but the fact that access cannot be tiered: people who do not need the data see it too, and when there is a leak it becomes impossible to find out who accessed it.

Role-based scope, masking and access logs in a digital personnel file

YazSis KurumsalPortal includes the Digital Personnel File & HR Management module, where access to the personnel file is permission-controlled: HR, authorised managers and employees see only the scope defined for their role. Sensitive fields such as the Turkish ID number and IBAN are masked. Access to documents is recorded in a document access log, and the platform also keeps an audit log. For details of how permissions are defined, see the Menu & Authorization Management module page.

These controls help you set up a KVKK-focused process. The portal alone does not replace your legal obligations: preparing the privacy notice, determining the legal basis of each data group and writing the retention policy remain the company’s job. The system runs on the customer’s own server, and employees access it from their phone’s browser without installing an app.

If you want to see role-based access, masking and access logs on a personnel file, visit the Digital Personnel File & HR Management page.