Why does KVKK directly affect the HR department?
KVKK (Kişisel Verilerin Korunması Kanunu, the Turkish Personal Data Protection Law No. 6698) regulates the processing of any information relating to an identified or identifiable natural person. In most companies, HR is the function that processes the most personal data, for the longest time and in the most sensitive categories. CVs, identity and address details, bank accounts, medical reports, time and attendance records, performance notes and payroll data all come together in a single employee file.
Under the law, the employer is the data controller for employee data: the party that decides why and how the data is processed and is responsible for its lawfulness. Parties such as your external payroll accountant, a cloud HR software provider or the occupational physician are, in most cases, data processors. This distinction shapes your contracts and the allocation of responsibility.
The concepts are close to the EU GDPR, but KVKK has its own rules, especially on legal grounds, registration and cross-border transfers. This guide is for general information. Decisions of the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) and secondary legislation can change, so confirm the current rules with the official source before applying them.
On what legal grounds can you process employee data?
Under KVKK, processing personal data generally requires explicit consent, but the law also lists cases where consent is not needed. Most HR processes rely on these exceptions. The most common legal grounds are:
- Expressly provided for by law: records required by the Labour Law, social security legislation and tax legislation.
- Formation or performance of a contract: data needed to perform the employment contract (for example, a bank account to pay salary).
- Compliance with a legal obligation: SGK (Social Security Institution) notifications, the MUHSGK (combined monthly withholding tax and social security) return, occupational health and safety records.
- Establishment, exercise or protection of a right: keeping records needed to defend a potential employment claim.
- Legitimate interest: the employer's legitimate interest, provided it does not harm the employee's fundamental rights and freedoms (for example, information security logs). When relying on this ground, carry out and document a balancing test.
For special categories of personal data, such as health, biometric data, union membership and criminal convictions, the law sets stricter conditions. A 2024 amendment broadened the conditions under which these data may be processed without explicit consent, for example to meet legal obligations in employment, occupational health and safety and social security. Additional security measures set by the Board must still be applied to special category data.
For biometric data, the Personal Data Protection Board's principle decision No. 2026/921 of 29 April 2026 (Official Gazette of 2 June 2026, No. 33268) also applies. Under the decision, processing fingerprints, facial recognition, iris, retina or other biometric data for working time tracking is not lawful, even with the employee's explicit consent. Use non-biometric methods such as cards, PINs, RFID/NFC, QR codes or location-based clock-in instead.
When is explicit consent needed, and when is it unnecessary?
Explicit consent is consent relating to a specific matter, based on information and given freely. Because the employee depends on the employer, it can be questioned whether consent in an employment relationship is truly free. Good practice is therefore: if another legal ground exists, do not ask for consent; ask for explicit consent only where no other ground applies.
| Processing | Typical legal ground | Explicit consent needed? |
|---|---|---|
| Identity, address, SGK notification | Provided by law, legal obligation | No |
| Paying salary to a bank account | Performance of contract | No |
| Pre-employment and periodic medical examinations | Obligation under occupational safety law | Generally no, with additional security measures |
| Sharing company event photos on social media | If no other ground applies | Yes |
| Keeping a CV in a talent pool for future roles | If no other ground applies | Yes |
| Fingerprint-based time and attendance | No legal ground is sufficient, including explicit consent; use cards, PINs, RFID/NFC, QR codes or location | not permitted for working time tracking (KVK Board decision 2026/921) |
When collecting explicit consent: keep it separate from the privacy notice, do not bury it in a clause of the employment contract, do not make hiring or a benefit conditional on it, and let the employee withdraw it at any time. Asking for consent "just in case" for processing that already has a legal ground leaves the process unclear if consent is withdrawn and is not recommended.
How do you prepare a privacy notice?
The duty to inform (aydınlatma yükümlülüğü) is separate from explicit consent and always applies. When data is collected, the data subject must be told:
- The identity of the data controller and its representative, if any
- The purposes for which personal data will be processed
- To whom and for what purposes the data may be transferred
- The method of collection and the legal ground
- The data subject's rights under KVKK
In HR, process-based notices are clearer than a single general text: a candidate notice, an employee notice, a CCTV and time and attendance notice, a visitor notice. Write them in plain language rather than filling them with legal citations, and in a language the employee understands; this matters for foreign staff. The burden of proving that the notice was given lies with the data controller, so keep a record of delivery (signature, email confirmation or system log).
How do you map data flows in HR processes?
The foundation of compliance is a personal data inventory showing where each data item comes from, where it is stored, to whom it is transferred and when it is deleted. Building the inventory process by process works well for HR:
| Process | Example data | Transfers | Retention approach |
|---|---|---|---|
| Recruitment | CV, interview notes | Hiring manager, recruitment agency | A short, defined period after rejection; separate consent for a talent pool |
| Onboarding | ID, address, diploma, medical report | SGK, occupational physician | During employment and for the statutory periods afterwards |
| Payroll | Salary, bank, family status | SGK, Revenue Administration, bank, accountant | Periods required by tax and social security law |
| Time and attendance | Clock-in and clock-out times, location | Payroll team | At least the limitation period for overtime and employee claims |
| Performance | Goals, review notes | Line manager, senior management | Period defined in company policy |
| Exit | Termination correspondence, release form | SGK, lawyer | Taking into account the 5-year limitation period for employee claims |
When setting retention periods, consider both the mandatory periods in the relevant legislation and the 5-year limitation period for employee receivables. Expired data is deleted, destroyed or anonymised under your personal data retention and destruction policy. Under the regulation, periodic destruction is carried out at intervals defined in the policy, not exceeding six months.
Do you need to register with VERBİS?
VERBİS (Veri Sorumluları Sicil Bilgi Sistemi, the Data Controllers' Registry) is the public registry for data controllers. Whether you must register depends on employee number and annual balance sheet thresholds set by the Board, and on whether your main activity involves processing special category data. Separate rules apply to data controllers established abroad. Because the thresholds are set by Board decision and can change, check your company's status in the latest announcement of the Personal Data Protection Authority. Being exempt from registration does not exempt you from the law's other obligations.
What should employers do about data security?
The law requires the data controller to take appropriate technical and organisational measures to prevent unlawful processing of and access to data. Key measures for HR:
- Role-based access: only the payroll team sees payroll data, only the occupational physician and authorised staff see health data
- Paper personnel files kept in locked cabinets with an access log
- Stop emailing bulk payroll spreadsheets; use encrypted and logged channels
- Data processing agreements with processors (software provider, accountant, physician)
- Regular KVKK training and confidentiality undertakings for the HR team
- System access for leavers closed on their last day
In the event of a data breach, the Board and the affected persons must be notified. Under a Board decision, notification to the Board must be made without delay and no later than 72 hours after the breach is discovered. Design your breach response plan to meet this deadline.
How quickly must you respond to an employee's data request?
An employee or candidate may exercise their rights under Article 11 of KVKK, for example to learn whether their data is processed or to request correction or deletion. The data controller must conclude the request as soon as possible depending on its nature and no later than 30 days. Define an application channel in HR (such as a dedicated email address or form) and a method for logging requests.
What about transferring employee data abroad?
If your group headquarters is abroad, or you use an HR system with servers outside Turkey or a foreign payroll provider, employee data is transferred abroad. The 2024 amendment introduced appropriate safeguards for cross-border transfers, such as adequacy decisions, standard contracts and binding corporate rules. Where standard contracts are used, the Authority must be notified within the set period. This is a frequent point for multinational employers: a group-wide HR system does not by itself make the transfer lawful under KVKK. Confirm which transfer tool applies and the current procedure in the Authority's secondary legislation.