The Principle Decision on Processing Identity Card Photocopies in the Tourism and Hospitality Sector Has Been Published

The Principle Decision dated 06.11.2025 and numbered 2025/2120 (Principle Decision) of the Personal Data Protection Board (Board) regarding the processing of photocopies of Turkish identity cards of individuals in the accommodation services offered in the tourism and hospitality sector was published in the Official Gazette dated 09.12.2025 and numbered 33102.

The key points are summarized below:

• In accordance with the Principle Decision, the recording of personal identification data such as the name, surname, and Turkish identity number of individuals receiving accommodation services is mandatory under the Identity Reporting Law No. 1774 and the Regulation on the Implementation of the Identity Reporting Law, and the personal data processing activities carried out within this scope are lawful.
• However, the Board has stated that obtaining and processing a photocopy of the Turkish identity card, even for identity verification purposes, constitutes excessive data processing and lacks any legal basis for such processing activity.
• In addition, it has been emphasized that if photocopies of the old identity cards are obtained, special categories of personal data, such as information on religion or blood type, would be processed unnecessarily.
• Considering these assessments, the Board has decided that data controllers operating in the tourism and hospitality sector must (i) cease the practice of obtaining photocopies of Turkish identity cards from guests and (ii) destroy any identity card photocopies obtained prior to the publication of the Principle Decision.

You may access the full text of the Principle Decision here.