Principle Decision on the Processing of Biometric Data for Attendance Tracking Published

The Personal Data Protection Board’s (Board) Principle Decision No. 2026/921 dated 29 April 2026 on the “Processing of Biometric Data for Attendance Tracking” was published in the Official Gazette dated 2 June 2026 and numbered 33268. The Principle Decision provides guidance on the assessment, under the Personal Data Protection Law No. 6698 (KVKK), of biometric identification systems such as fingerprint, facial recognition, iris scan, and retina scan technologies used by employers for attendance tracking purposes, and sets out important considerations for employers.

The key points of the Principle Decision are summarized below:

• The Board emphasizes that biometric data constitutes special categories of personal data and, due to its sensitive nature and irreversible characteristics, requires a high level of protection when processed.
• The Principle Decision notes that, although applicable legislation requires working hours to be monitored and recorded, there is no explicit legal provision mandating the fulfilment of this obligation through the processing of biometric data.
• The Board further states that, due to the imbalance of power inherent in the employer–employee relationship, there may be doubts as to whether employees’ explicit consent is truly given freely and, therefore, explicit consent alone may not always constitute a sufficient legal basis for processing biometric data.
• The Board underlines that the processing of biometric data for attendance tracking purposes must be assessed considering the principles of proportionality, necessity, and data minimization, and that the use of biometric data may result in unlawful outcomes where alternative and less intrusive methods are available.
• The Principle Decision identifies less intrusive alternatives, including access cards, PIN-based systems, personnel attendance sheets, RFID/NFC identity cards, and monitored entry-exit records.
• The Board highlights that, even where the data subject has provided explicit consent, the processing of biometric data for attendance tracking purposes may, in most cases, be considered contrary to the principle of proportionality under the general principles of the KVKK.
• The Principle Decision also states that the matters addressed therein fall within the scope of the technical and administrative measures that employers are expected to implement, and that sanctions under the KVKK may be imposed in cases of non-compliance.