- See All
- Altyapı Projeleri & Proje Finansmanı
- Birleşme & Devralmalar
- Banka & Finans
- Enerji & Doğal Kaynaklar
- Gayrimenkul Hukuku
- Rekabet Hukuku
- Uluslararası Ticaret ve Gümrük
- Kişisel Verilerin Korunması
- Genel Şirketler Hukuku
- Uyuşmazlık Çözümü
- Sermaye Piyasaları
- Beyaz Yaka Suçları & Yolsuzlukla Mücadele
- Varlık ve Servet Yönetimi
The Turkish Data Protection Authority (the “DPA”) has clarified its approach to the use of biometric identification systems for attendance tracking in the workplace through its Principle Decision on the Processing of Biometric Data for Attendance Tracking (the “Principle Decision”), published in the Official Gazette dated 2 June 2026 and numbered 33268.
As the use of fingerprint scanners, facial recognition systems and similar biometric technologies for employee attendance tracking has become increasingly common in recent years, the DPA emphasizes that these practices should be assessed not only in terms of the applicable legal bases for processing, but also in light of the principles of proportionality, necessity and data minimization.
A Higher Standard of Protection for Biometric Data
The Principle Decision focuses on biometric systems used for attendance tracking. The DPA reiterates that biometric data constitutes sensitive personal data and, due to its irreversible nature, requires a higher level of protection than many other categories of personal data.
In this context, the DPA notes that the use of biometric systems such as fingerprint scanners, facial recognition technologies, iris scans, and retina scans should be subject to a separate assessment from a data protection law perspective.
Explicit Consent May Not Always Be Sufficient
One of the notable aspects of the Principle Decision is the DPA’s assessment that explicit consent obtained from employees may not, on its own, constitute a sufficient legal basis for the processing of biometric data.
The DPA notes that, by its nature, the employer-employee relationship does not place the parties on an entirely equal footing and that employees’ explicit consent cannot always be assumed to have been given freely. Accordingly, the DPA indicates that relying solely on explicit consent as the legal basis for the processing of biometric data may give rise to significant concerns in practice.
Emphasis on Proportionality and Alternative Methods
One of the key messages of the Principle Decision concerns the DPA’s assessment of the principle of proportionality.
The DPA points out that attendance tracking can also be achieved through less intrusive methods, such as password-protected cards, employee ID cards, PIN-based systems, RFID/NFC-based solutions, or signature sheets. Accordingly, where the same objective can be achieved through less intrusive means, the use of biometric data may fail to satisfy the principle of proportionality.
Key Considerations for Employers
The Principle Decision serves as an important indication that biometric systems used for attendance tracking will be subject to closer scrutiny from a data protection law perspective.
In this context, employers would be required to:
- Reassess whether the use of biometric data is genuinely necessary for attendance tracking purposes,
- Evaluate whether the same objective can be achieved through alternative methods,
- Review the legal bases relied upon and the relevant data processing activities; and
- Reconsider the technical and organizational measures implemented for the protection of sensitive personal data.
The approach adopted by the DPA suggests that, rather than prohibiting the use of biometric systems in the workplace altogether, such practices will be subject to a more rigorous assessment against the requirements of necessity and proportionality.