KVKK Principle Decision No. 2026/921: The End of Biometric Attendance Tracking at Workplaces
With the acceleration of digital transformation, many businesses preferred biometric methods such as fingerprint scanning, facial recognition, or retina scans in their Personnel Attendance Control Systems (PDKS). However, the principle decision dated April 29, 2026, and numbered 2026/921 issued by the Turkish Personal Data Protection Board (KVKK) brought a vital legal obligation to the corporate world. The Board explicitly ruled that processing employees' biometric data for monitoring working hours is unlawful.
What are the legal grounds behind this radical decision, and what steps should businesses take to avoid administrative fines? Here are the details...
The 3 Main Legal Grounds of the Prohibition
The KVKK does not completely prevent employers from tracking working hours digitally; however, it strictly blocks this tracking from being done via biometric data. There are three main pillars at the core of the Board's decision 2026/921:
Lack of Explicit Statutory Basis: Although labor laws grant employers the authority to supervise working hours, there is no explicit legal provision requiring this supervision to be performed using irreversible biometric data (face, fingerprint, etc.).
Power Imbalance and "Invalid" Explicit Consent: Many companies argued that they used these systems by obtaining "explicit consent forms" from their employees. However, the Board points out that due to the hierarchical structure between the employee and employer, staff members cannot express their consent with free will. Consent given under the fear of losing a job or administrative pressure is legally void.
Violation of the Proportionality Principle: One of the most critical elements in Article 4 of the KVKK Law is the principle of "proportionality." Collecting biometric data, which is impossible to replicate or change, for a simple purpose like detecting clock-in and clock-out times is considered an excessive and disproportionate intervention.
Critical Warning: Even if you have obtained signatures from all your employees, continuing to track attendance via fingerprint or facial recognition constitutes a violation of technical and administrative measures under Article 12 of the Law, leading to severe administrative fines.
Legal and Compliant Alternatives for Businesses
In this new era, it is a critical necessity for companies to switch to alternative technologies that do not collect biometric data in order to stay away from legal risks and achieve compliance.
Here are the legal alternative solutions you can implement smoothly:
Card and PIN-Based Access Systems: RFID or NFC-based Mifare (13.56 MHz) cards and personalized PIN codes are among the safest and legally risk-free methods.
Mobile Attendance (PDKS) Solutions: Modern software that allows employees to clock in and out using location-based (GPS) or QR code scanning methods via their own smartphones.
Web and Desktop Applications: Time tracking logs provided with a username and password from in-office computers or terminals connected to the corporate network.
As KuzeyPDKS, we provide your transition to 100% KVKK-compliant time attendance systems without risking your business data security, thanks to our encryptable card access and modern hardware infrastructures. We highly recommend revising your current systems immediately to avoid legal sanctions.
