The Personal Data Protection Board (the “Board”), through its Principle Decision No. 2026/921 dated 29 April 2026, consolidated its assessments and approach regarding the processing of biometric data for attendance tracking purposes under a principle decision (the “Principle Decision”). The Principle Decision has been published in the Official Gazette dated 2 June 2026 and numbered 33268, as well as on the website of the Personal Data Protection Authority.
Key Considerations Highlighted in the Principle Decision
Biometric data, which enable the unique identification of individuals, are classified as special categories of personal data. Given the sensitive nature of such data and the fact that, once compromised, they cannot be changed or revoked, their protection is of particular importance. The Board specifically emphasizes this characteristic of biometric data in the Principle Decision.
The Principle Decision includes significant assessments regarding the use of biometric data, such as fingerprint, facial recognition, iris scan, or retina scan data, by employers for attendance tracking purposes. The Board underlines that the processing of biometric data should not be assessed solely on the basis of a legal ground for processing, but also in light of the principles of necessity, proportionality, and data minimization. In this context, the Board refers to the following considerations.
- Special categories of personal data may only be processed where one of the legal grounds explicitly set out in Article 6 of the Personal Data Protection Law No. 6698 (the “Law”) is present. In the context of processing biometric data for attendance tracking purposes, none of the legal grounds listed in Article 6, other than explicit consent, appear to be applicable. However, due to the imbalance of power inherent in the employer-employee relationship, it becomes questionable whether the employee's consent can genuinely be regarded as freely given. For this reason, the Board adopts a cautious approach towards relying on explicit consent as the basis for processing biometric data for attendance tracking purposes and indicates that explicit consent alone should not be considered a sufficient legal basis.
- The Board's decision places particular emphasis on the principle of proportionality and states that, in attendance tracking activities, the least intrusive method should be preferred to achieve the intended purpose. Accordingly, where the same objective can be achieved through the processing of less data, the use of biometric data is not considered compatible with the principle of proportionality. In this regard, the Board notes that alternative methods such as password-protected card systems, PIN-based systems, RFID/NFC cards, traditional attendance sheets, or attendance control under the supervision of an authorized person are available. Given the existence of such alternatives, the necessity and proportionality of processing biometric data for attendance tracking purposes become difficult to justify. The Board therefore concludes that, even where explicit consent has been obtained, the processing of biometric data for attendance tracking purposes would not satisfy the proportionality requirement under the general principles of the Law.
Conclusion
In conclusion, the Board noted that, although Turkish legislation contains provisions regarding the monitoring of working hours, it does not include any explicit requirement for such monitoring to be carried out through the processing of biometric data. In this context, the Board did not consider explicit consent to be an appropriate legal basis for the processing of biometric data for attendance tracking purposes and further emphasized that such processing must also be assessed in light of the general principles of the Law, particularly the principles of necessity, proportionality and data minimization.