Public Announcement of the Personal Data Protection Authority Regarding the Use of Security Cameras in Workplaces

The Personal Data Protection Authority (Authority), through its “Public Announcement on Matters to be Considered in the Use of Security Camera Systems in Workplaces” published on 8 June 2026, clarified the fundamental principles and obligations to be complied with in personal data processing activities carried out through security camera systems in workplaces.

The announcement states that employers may benefit from camera systems for the purposes of ensuring security, occupational health and safety, and fulfilling their legal obligations; however, it emphasizes the importance of conducting such activities in compliance with the Personal Data Protection Law No. 6698 (KVKK).

The main points highlighted by the Authority are as follows:

• The necessity of using security cameras should be assessed on a concrete basis, the principle of data minimization should be observed, and the purpose of processing should be clearly and specifically determined from the outset.
• Camera systems should be used for legitimate purposes such as workplace security, crime prevention, or ensuring occupational health and safety; general surveillance activities aimed at monitoring employees’ performance, productivity, or attendance should be avoided.
• Camera placement, viewing angles, the scope of recording, and the frequency of monitoring should be determined in accordance with the principle of proportionality, taking into account employees’ reasonable expectations of privacy. Camera systems should not be used in private areas such as restrooms, changing rooms, prayer rooms, and rest areas. • Intensive surveillance practices, such as wide-angle recordings covering all areas of the workplace or face-focused recordings, should not be carried out due to the risk of interference with individuals’ private lives.
• The use of cameras equipped with audio recording functionality should only be considered where there is a lawful and necessary justification, as such use constitutes a high level of interference with the right to privacy.
• The impact on customers, visitors, children, and other vulnerable groups present in areas of the workplace open to the public should also be taken into consideration.
• Employees should be informed about personal data processing activities carried out through camera systems, and the obligation to inform should be fulfilled in accordance with the applicable requirements.
• Necessary technical and administrative measures should be implemented to ensure the security of camera recordings, including the establishment of an authorization matrix, the implementation of access controls, and the preparation of procedures to ensure the security and confidentiality of the recordings. Camera recordings should not be disclosed to unauthorized persons without authorization.
• Camera recordings should be retained only for as long as necessary, the shortest possible retention period should be preferred, and automatic destruction mechanisms should be used where appropriate. In the event of an incident, only the relevant recording should be retained for the duration of the legal proceedings.
• The Authority stated that, where non-compliance with the aforementioned obligations is identified, administrative fines may be imposed on data controllers pursuant to Article 18 of the KVKK.