Personnel file retention in Turkey: how many years, and what is a KVKK destruction policy?

The archive cabinet is being moved, and on the bottom shelf are the folders of employees who left between 2014 and 2018. Someone asks: “Can these go in the bin?” If the answer is “yes”, you may be left defenceless in a lawsuit or an SGK inspection. If the answer is “no”, your KVKK responsibility for personal data kept unnecessarily continues. There is risk in both directions; so the answer to the personnel file retention question should not be one period for everything, but a table by document type. This article brings together the Turkish statutory provisions an employer in Turkey needs to build that table.

The personnel file retention period is the period during which an employer in Turkey is legally required to keep the documents and records in an employee’s personnel file, or has a legal interest in keeping them; the Turkish Labour Law does not set a single figure for this period.

Is the personnel file retention period written in Turkish law?

Article 75 of Turkish Labour Law No. 4857 requires the employer to set up a personnel file for every employee and to keep in it the documents and records it must prepare under the law. The article does not specify a retention period. The period comes from other laws and general legal rules. That is why the honest answer to “how many years must a personnel file be kept” depends on which document you are talking about.

Personnel file retention periods: criteria by document group

Distinguish between two concepts. The first is the obligation to retain; it is set by the period the law states explicitly (Article 86 of Law No. 5510). The second is a legitimate interest in retaining; until the limitation period expires, both employee and employer can bring claims, and the document is your defence. The second is not a legal retention obligation but a risk assessment. Even so, the cost of discarding a document early usually shows up in a lawsuit.

How long is a leaver’s personnel file kept?

The ten-year period in Article 86 of Law No. 5510 runs not from the employee’s leaving date but from the year the document relates to. For example, for a document from 2019 the period starts on 1 January 2020 and ends on 31 December 2029. The leaving date, on the other hand, matters for when the limitation period starts for claims such as compensation and leave pay.

In practice, split the file into two groups: SGK and wage documents, and documents relating to the departure. A cautious approach is to keep the entire file for ten years after the employee leaves. This is not a legal provision but a preference derived from the ten-year periods above; decide it with your legal adviser according to your own risk. Keep a copy of the employment certificate given to the leaver (Labour Law Art. 28) and the termination or resignation correspondence in the file. If there is an ongoing lawsuit, objection or inspection, do not put that file on the destruction list even if the period has expired.

Sample period table for a retention and destruction policy

Building the policy’s table of retention and destruction periods from a blank page is hard. The rows below are a sample starting point; clarify the periods with your own legal adviser and adapt the table to your workplace.

How is the personnel file retention period set under KVKK?

KVKK requires personal data to be kept for as long as the relevant legislation provides or as long as necessary for the purpose for which it is processed (Art. 4). When the reasons requiring processing no longer exist, the data is erased, destroyed or anonymised ex officio or at the request of the data subject (Art. 7). In other words, KVKK does not give you a number; it asks you to ask “why am I keeping this, and has that reason ended?”

Those required to register with the Data Controllers Registry prepare a personal data retention and destruction policy in line with their personal data processing inventory (Erasure Regulation Art. 5). Having prepared a policy does not mean the data is retained appropriately; the obligation does not end with preparing the policy. Data controllers who are not required to prepare a policy still have retention and erasure obligations. At a minimum, the policy covers the following (Art. 6):

• The purpose of the policy.
• The recording media the policy covers.
• Definitions of the legal and technical terms used.
• The legal, technical or other reasons requiring retention and destruction.
• Technical and administrative measures taken for secure retention and to prevent unauthorised access.
• Technical and administrative measures taken for lawful destruction.
• Titles, departments and job descriptions of those involved in retention and destruction.
• A table showing retention and destruction periods.
• Periodic destruction intervals.
• Updates made to the policy.

What do you do when the retention period expires? Destruction steps

1. List the expired documents by document type and date.
2. For each document, check whether there is an ongoing lawsuit, objection or inspection.
3. Choose the destruction method: erasure, destruction or anonymisation; the data controller explains these methods in its policy and procedures (Erasure Regulation Art. 7).
4. Carry out destruction with the approval of an authorised person.
5. Record the destruction operations; these records are kept for at least three years, other legal obligations excepted (Art. 7).
6. If you have prepared a policy, carry out destruction at the first periodic destruction after the date on which the obligation to destroy arises; the periodic destruction interval may in no case exceed six months (Art. 11).

Where does tracking retention periods with Excel and folders break down?

You can keep a “destruction date” column for every document; in a small archive this works. The weak points are confusion over which date the period counts from: the document date, the employee’s departure, or the start of the following year. Physical and digital copies are tracked separately and one gets forgotten. The periodic destruction date does not make it into the calendar, no record is kept when destruction is carried out, and the rule of keeping destruction records for three years is missed.

Document validity, versions and access logs in the portal

In YazSis KurumsalPortal, the Digital Personnel File & HR Management module stores document versions and approvals, sends alerts before documents’ validity periods expire and records who accessed the file in the document access log. Personnel documents are kept on the customer’s own server, and fields such as the Turkish ID number and IBAN are masked.

One distinction matters here: the validity alert concerns the document’s own term (for example, a document that needs renewing). The retention and destruction period is a separate concept. In this article we do not claim that the module destroys documents automatically when the retention period expires. To manage the text of your retention and destruction policy as a company policy, you can also look at the Document & Policy Management module page.

If you want to see document versions, validity alerts and access logs in a single file, you can review the modules on the KurumsalPortal page.