Personal Data Protection Authority of Türkiye has published a principle decision and an announcement regarding the processing of biometric data by employers as part of monitoring employees’ attendance and time tracking; highlighting the principle of proportionality and advising alternate methods to employers.

Principle decision of the Personal Data Protection Board (the “Board”) dated 29 April 2026 and numbered 2026/921 (the “Resolution”) regarding the processing of biometric data for time and attendance tracking purposes, was published in the Official Gazette dated 2 June 2026 and numbered 33268. Board has also published an announcement on the same date summarizing the Resolution.

Board has evaluated the lawfulness of the processing of biometric data by employers as part of monitoring employees’ attendance and time tracking, highlighting the principle of proportionality and certain regulations for reference. Pursuant to the Resolution:

• Biometric data is classified as sensitive data under the Personal Data Protection Law No. 6698 (the “Law”). To process sensitive data, one of the sensitive data processing conditions stipulated in the Law must be met. The conditions outlined in the Law are not applicable to the processing of biometric data; hence, relying on explicit consent is preferred in practice.
• Since the balance of power between the employer and the employee is not equal; the argument of employee’s explicit consent being based on free will, cannot be claimed. Therefore, an explicit consent alone does not constitute a sufficient legal ground for processing.
• Under the general principles of the Law, data processing activities must be “relevant, limited, and proportionate to the purposes for which they are processed”. Accordingly, the least intrusive method must be preferred for data processing activities; alternative methods must not be used.
• Since employers can track attendance and time using alternative methods instead of biometric data processing such as cards or pin-coded systems, the principle of proportionality is also not satisfied.

Within this scope, it is stated that none of the specifical categories of personal data processing conditions in the Law are met, and even if valid explicit consent exists, the processing activity in question does not satisfy the principle of proportionality.

Therefore, it is concluded that attendance tracking must be provided through alternative methods rather than biometric data processing, and processing biometric data in this context is unlawful.

Under the General Data Protection Regulation (“GDPR”), biometric data is also classified as a sensitive data, and the definition of biometric data is explicitly provided within the GDPR itself.

Previously, the Belgian Data Protection Authority fined an employer 45,000 Euros for processing employees’ biometric data (fingerprints) in violation of the GDPR. In this context, the Belgian DPA also underlined that alternative, less intrusive methods were not utilized instead of biometric data processing.

Similarly, the Spanish Data Protection Authority has published a guideline on the processing of biometric data, further clarifying the boundaries for biometric data processing activities.

Therefore, if a less intrusive, and alternative method is available, the biometric data processing activity for employee monitoring purposes lacks a valid legal ground. In this regard, practices in both Türkiye and the EU progress in substantial alignment.