The Personal Data Protection Board (“Board”) published its Principal Decision dated 6 November 2025 and numbered 2025/2120 on the Recording of Photocopies of Turkish Identity Cards of Individuals Receiving Accommodation Services in the Tourism and Hospitality Sector (“Principal Decision”) in the Official Gazette dated 9 December 2025 and numbered 33102, as well as on the website of the Personal Data Protection Authority (“Authority”)
With the Principal Decision, the Board states, in summary, that obtaining photocopies of Turkish identity cards from individuals accommodated in accommodation facilities (“
Accommodation Facilities”) within the scope of activities in the tourism and hospitality sector constitutes excessive data processing and therefore violates the Personal Data Protection Law No. 6698 (“
KVKK”), and that such practices must be terminated. In this context, the Board clarifies the limits of Accommodation Facilities’ obligations regarding identity verification and registration under the Identity Reporting Law No. 1774 (“
Identity Reporting Law”) in terms of personal data processing.
I. Evaluations Regarding the Principal Decision and Implementation of the Principal Decision:
In its assessment within the Principal Decision, the Board states that the data processing activity implemented by Accommodation Facilities in the form of recording identity information consisting of name, surname, and Turkish ID number pursuant to the Identity Reporting Law constitutes a lawful data processing activity, as it is explicitly stipulated by law and necessary for the data controller to fulfill its legal obligation.
Regarding the scope of personal data processing implemented for the purpose of fulfilling a legal obligation, the Board emphasizes that, for the identity verification and registration obligation imposed by the Identity Reporting Law,
it is sufficient for Accommodation Facilities to record only the specified information and to request the identity document for verification purposes. Additionally, the Board further notes that
obtaining and recording a photocopy of the identity document results in the processing of data beyond the requirements of the legal obligation.
Accordingly, the Board concludes that the recording of photocopies of Turkish identity cards is a data processing activity that exceeds the scope of the legal obligation under the Identity Reporting Law, lack of a legal basis, and is therefore unlawful under the KVKK.
The Board also states that recording the old form of identity cards, which contains information such as religion and blood type, would constitute a violation of the KVKK provisions on the protection of special categories of personal data.
Finally, The Board states that the personal data requested from the customers for invoicing purposes due to purchasing of an accommodation service in the tourism and hospitality sector will also be lawful on the legal basis of being ‘explicitly stipulated in laws,’ providing that such processing is strictly limited to the requirements set forth in the Tax Procedure Law No. 213 (“
VUK”).
II. Conslusion
In summary, within the scope of the Principle Decision, data controllers operating in the tourism and hospitality sector may process personal data by requesting the Turkish Identity Card from guests, recording the required information and verifying its accuracy, and returning the card after the verification. It is stated that any processing activity exceeding this limit would be unlawful. In this regard, as also stated by the Board in the Principal Decision, Accommodation
Providers are required to:
- cease the practices of obtaining photocopies of Turkish ID cards; and
- in compliance with the KVKK, destroy any photocopies or related documents that were recorded prior to the publication of the Principal Decision.
If Accommodation Facilities fail to cease the practice of obtaining photocopies of identification documents and/or fail to carry out the required destruction of the existing documents, they may face administrative and judicial sanctions under the KVKK, due to the failure to implement necessary administrative and technical measures and the failure to destroy personal data that must be eliminated.
You may access the full Turkish text of the Principal Decision published by the Authority
here.
Işılay Işık, Associate
Aleyna Katırağ, Trainee Lawyer