Anyone planning a face recognition system eventually asks: "Is this compliant with KVKK, Türkiye's data protection law?" The short answer: it is not the system itself but its purpose, who it applies to, and how it is run that decide. This guide summarizes how Türkiye's Personal Data Protection Board treats biometric data, the latest restriction on employees, and the questions to answer before you install anything.
This article is general information, not legal advice. Consult a lawyer about your own situation.
Why is face data "special category" personal data?
Law No. 6698 on the Protection of Personal Data (KVKK) treats data obtained through technical processing of a person's physical characteristics and that uniquely identifies them (fingerprints, face recognition, iris) as biometric data. Under Article 6 it counts as special category personal data. The reasoning is simple: you can change a password, you cannot change your face. If such data leaks, the harm is irreversible.
Processing special category data involves two layers:
- One of the processing conditions in the Law must apply (in most cases, explicit consent).
- The adequate measures set by the Board in its Decision No. 2018/10 of 31.01.2018 must be taken. These include a written policy, defined and regularly audited access rights, and protecting the data with cryptographic methods such as encryption.
A legal basis is not enough: proportionality
The Board's guidance on biometric data stresses that a legal basis alone is not sufficient. Processing must also respect the principles of necessity, proportionality and data minimization. Ask yourself: could I reach the same goal with a less intrusive method, such as a card, a PIN or an ID check? If so, a biometric method may not be considered proportionate.
The rule on consent is clear too: explicit consent must be specific, informed and given freely. If a person who declines is not offered a reasonable alternative, it becomes hard to argue the consent was free.
A key development for employers: working-time tracking
In Principle Decision No. 2026/921 of 29.04.2026, announced publicly in June 2026, the Board addressed the processing of biometric data for working-time tracking. The decision covers systems such as fingerprint, face recognition, iris and retina scanning. Key points from the announcement:
- Recording working hours is a legal obligation, but no explicit provision requires it to be done with biometric data.
- Because of the imbalance of power between employer and employee, whether an employee's consent is freely given is doubtful. Relying on explicit consent alone to process biometric data for time tracking was found neither a sufficient legal basis nor proportionate.
- Biometric methods should not be chosen where less intrusive alternatives exist, such as encrypted cards, PINs, RFID/NFC ID cards, signatures or supervised manual entry.
- The Board noted that sanctions may be applied to practices that contradict these principles.
Before this decision, the Board had already found the use of face recognition for factory entry and exit (Decision 2022/797) contrary to the proportionality principle and imposed an administrative fine, criticizing biometric processing where alternatives existed as well as bundled, multi-purpose consent texts.
The decision focuses on working-time tracking; it does not separately regulate other purposes such as security or access control. That is not a free pass for those purposes: the same proportionality test applies.
What about Northern Cyprus (KKTC)?
Türkiye's KVKK and Board decisions do not apply directly in KKTC. KKTC has its own Law on the Protection of Personal Data No. 89/2007, and a Personal Data Protection Board operates under it. A face image is personal data in KKTC too, and the duties to inform data subjects and to secure the data apply. The law's definition of "sensitive data" does not explicitly list biometric data, but that does not mean no additional care is needed for face recognition. Businesses operating in KKTC and Türkiye, or with employees from both, should get an opinion from a local lawyer.
7 questions to answer before installing
- What is the purpose? Entry security, visitor registration, or time tracking? Do not pick a method before the purpose is clear.
- Is there a lighter alternative? If a card, PIN or ID check does the job, why biometrics?
- Who is covered? Employees, visitors, customers? For employees, consent is a weak basis.
- Consent and alternative: Is an equivalent, penalty-free option offered to anyone who prefers not to take part?
- Notice: Is it explained in writing whose data is processed, for what purpose, and for how long?
- Security: Is the data encrypted, who can access it, and are accesses logged? Is a photo stored, or a mathematical template?
- Retention and deletion: Is it clear when and how data is deleted, including for departing employees and visitors? (In Türkiye, also check whether you must register in the data controllers' registry.)
Camera placement matters too: cameras near areas with a high expectation of privacy, such as toilets or changing rooms, were treated as a separate problem in the Board's decisions.
How MIO Tech approaches it
Before installing our face recognition systems (Face Guard, SelfPass, Presence), we review the purpose, the necessity and the alternatives with you. We plan the notice and consent processes and the data retention and deletion settings around your business. Sometimes the right answer is a non-biometric method, and we will say so plainly.
If you would like an assessment for your project, get in touch.
Frequently asked questions
Is a face recognition system against KVKK?
No, the system alone is not. Lawfulness depends on the purpose, the legal basis, proportionality, notice and the security measures taken. For working-time tracking, the Board's latest decision means biometric methods should be avoided.
If I get an employee's explicit consent, can I use face recognition for time tracking?
According to the Board's Principle Decision 2026/921, relying on explicit consent alone to process biometric data for time tracking is not considered a sufficient legal basis and is not found proportionate. Alternatives such as cards, PINs or RFID are recommended.
Can face recognition be used for visitors?
Explicit consent can be a more meaningful basis for visitors than for employees, but the proportionality test and the duty to offer an alternative still apply. Someone who prefers not to take part should have another option, such as an ID check.
How long should face data be kept?
No longer than the purpose requires. Decide the period in advance, state it in the notice, and delete or anonymize the data when it expires.