Visitor privacy notice under KVKK in Turkey: contents, ID checks and retention period

In a factory’s security booth, a visitor writing their name in the logbook asks: “What is this information for, and how long will it be kept?” The guard shrugs; there is a sheet of paper on the booth wall, but nobody reads it, and the visitor, in a hurry, signs and walks on. The next day another visitor asks why their ID number is being written down, and nobody has a clear answer. Moments like these show that the notice is not paperwork but part of how the visitor log is designed. Based on the official Turkish texts, mainly Turkey’s Personal Data Protection Law No. 6698 (KVKK), this article explains what a visitor privacy notice should contain and how to handle taking ID and retention periods.

A visitor privacy notice tells a person coming to a site who processes their personal data, for what purpose, how and on which legal basis, to whom it may be transferred and what their rights are. Its legal basis is Article 10 of Turkish Law No. 6698 on the Protection of Personal Data.

When does the obligation to inform arise in visitor registration?

Article 10 of the Law requires the data controller to inform data subjects on certain points when personal data is collected. For a visitor, this moment is when their name and company are written in the logbook or entered in a digital form. According to the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, informing does not depend on the data subject’s request; information must be given even if the visitor does not ask. The same Communiqué states that the burden of proving that the information was given lies with the data controller. So what matters is not only that the notice is posted, but also a record that the visitor was informed.

Which headings should a visitor privacy notice include?

Article 10 of the Law and Article 4 of the Communiqué list the minimum content of the information. The table below adapts these headings to visitor registration; the sample wording is only a guide, and you should write the text according to your own processes.

How is the notice given to visitors in practice?

The Communiqué states that information can be given orally, in writing or electronically. What matters more than the method is that the visitor is really informed and that this can be shown. A workable checklist for reception could look like this:

1. Place a short notice where the visitor can see it during registration; it should be short enough to read at a glance.
2. Show how to reach the full notice; this can be a printed copy or the full text opening on a screen.
3. Prepare a note for the receptionist summarising the purpose, retention period and how to apply, so they can answer questions.
4. Consider an understandable version of the notice for foreign visitors and other language needs.
5. Record that the visitor was informed; for example, a signature line on paper or a confirmation step in a digital record.
6. Review the notice once a year and whenever the process changes, and keep the current version with its date.

Common mistakes in visitor privacy notices

Article 5 of the Communiqué contains detailed principles on how information should be given. In practice, these points are missed most often:

• Writing a vague purpose: phrases such as “for various purposes” or “for other purposes where necessary” do not meet the Communiqué’s principle of a specific and explicit purpose.
• Not stating the legal basis: the notice should state clearly which processing condition under Articles 5 and 6 of the Law the personal data relies on.
• Using language that is hard to understand: information should be given in clear, plain language; at the door, a visitor needs a text short and clear enough to read.
• Merging the privacy notice with the consent text: if processing relies on explicit consent, the notice and the consent should be handled separately.
• Mixing up departments: if different departments process data for different purposes, information should be given separately for each; for example, reception and car park registration may not share the same notice.
• Not updating when the purpose changes: when the purpose of processing changes, information for the new purpose must be given separately before processing.

Can you take ID from visitors?

There is no single answer to this question that applies to every workplace. The test is the principle in Article 4 of the Law: processed data must be relevant, limited and proportionate to the purpose for which it is processed. If your security purpose is met by verifying the visitor’s name and company, collecting an ID number or a photocopy of the ID card may stretch this test.

In its principle decision No. 2025/2120 dated 6 November 2025 on the accommodation sector, Turkey’s Personal Data Protection Board stated that an identity document may be requested for verification, but that taking and recording a photocopy of it results in processing more data than necessary. The decision is for accommodation businesses such as hotels and relies on a separate law; it does not apply directly to visitor registration. Still, it is a useful guide because it shows the difference between “showing” and “copying” and the data minimisation approach.

How long are visitor records kept?

Law No. 6698 does not set a specific period for visitor records. Article 4 of the Law requires data to be kept for the period set out in the relevant legislation or as long as necessary for the purpose for which it is processed; Article 7 provides that data is deleted, destroyed or anonymised when the reasons requiring processing no longer exist. If you have a retention period for visitor records arising from other legislation, ask your legal adviser.

The Regulation on the Erasure, Destruction or Anonymisation of Personal Data sets out this framework: those obliged to register with the Data Controllers’ Registry prepare a retention and destruction policy. For a data controller that has prepared a policy, the periodic destruction interval is set in the policy and cannot exceed six months; a data controller with no obligation to prepare a policy carries out deletion within three months after the obligation to delete arises. Deletions are recorded, and these records are kept for at least three years, other legal obligations aside.

Can a visitor logbook or Excel be used for KVKK-focused record keeping?

A paper logbook and a spreadsheet can be used, but the notice, access and retention management are handled by hand. In a paper logbook, every visitor’s details on the page are visible to the next visitor, and a single expired row cannot be deleted. In Excel, who accesses the file, when expired rows are deleted and the record of deletion depend on people’s discipline. Sending visitor information to personal accounts such as WhatsApp makes control harder from a data security point of view.

How does KurumsalPortal Visitor Management support the notice and consent record?

In the Visitor Management module, KVKK consent is a step in the registration flow: after the visitor is registered, consent is obtained, then the host is notified and entry begins. Because the consent is stored with the visit record, it can be checked later. Records are kept on the customer’s own server, and who can see them is set with role-based permissions; for the permission approach, see the Menu & Authorization Management page.

The module’s role is to keep consents and records in order; the content of the privacy notice and the choice of legal basis must be prepared according to the organisation’s own assessment under KVKK. In the module this step is called “KVKK consent”; decide with your legal adviser which processing condition the consent corresponds to in your case.

To see visitor registration, KVKK consent and the list of people on site in a single flow, take a look at the KurumsalPortal Visitor Management page.