Time and attendance systems in Turkey: how to set one up

What is a PDKS and why do employers in Turkey use one?

PDKS (personel devam kontrol sistemi, the Turkish term for a time and attendance system) records when employees clock in and out and turns those records into working time. Its purpose is not just to spot late arrivals. A well set up PDKS gives the monthly timesheet, and therefore payroll, a reliable input, documents overtime, and becomes one of the employer's most important records if a dispute arises.

In Turkey the maximum working week is 45 hours. Time above that is overtime, paid at a 50% premium and capped at 270 hours a year, and the employee's written consent is required. Because the limitation period for employee wage claims is 5 years, working time records need to be kept in an orderly form that can be read back years later. For the overtime rules in detail, see the overtime rules and pay guide.

Which decisions come before choosing a system?

PDKS projects often start with hardware, but the device should be the last decision. Answer these first:

• Which locations and how many employees will be covered? Will field, office and remote staff be handled separately?
• Do you use fixed hours, shifts or flexible working?
• Will breaks be clocked, or deducted as fixed time in the shift definition?
• Is there a grace period for late arrival and early departure, and does it create rounding against the employee?
• Is overtime counted only when there is an approved request, or suggested automatically from clock data?
• How will data move into the timesheet and payroll?

Turn these decisions into a written working time policy and share it with employees. If the rules are vague, month end disputes will be resolved by hand no matter how good the system is.

Which attendance method should you choose?

Weigh reliability, cost, ease of use and personal data risk together. The table compares common methods in general terms:

Many companies use a mix: card or QR in the office, mobile in the field, web for remote staff. What matters is that records from every method are processed under the same rules.

How should PDKS data be handled under KVKK?

Attendance records are personal data: identity, clock times, door or location used. Under KVKK (Turkey's Personal Data Protection Law), the employer is the data controller and must process this data lawfully, for a specific purpose and proportionately.

Why does biometric data need special care?

Biometric data such as fingerprints, facial geometry, palm vein patterns, iris and retina scans is special category personal data under KVKK. Under the Personal Data Protection Board's principle decision 2026/921 of 29 April 2026 (Official Gazette of 2 June 2026, issue 33268), processing biometric data for working time tracking is unlawful even where the employee has given explicit consent. The Board took the view that the purpose of recording clock in and out can be met by less intrusive means such as card, PIN, RFID/NFC, QR code or location based clock in, and that consent in an employment relationship is rarely genuinely free. Biometrics should therefore not be treated as an option for attendance.

If a biometric system is still in use:

• Stop using biometric readers for working time tracking and move to card, PIN, RFID/NFC, QR code or mobile clock in.
• Run the new method as a pilot before the switch so that no gap appears in the records.
• Delete stored fingerprints, face templates and similar data from devices and backups, and record the destruction in writing.
• Update the data inventory, the retention and destruction policy and the privacy notice.
• Do not keep processing on the basis of consent forms collected earlier; tell employees about the change in writing.

What about non biometric methods?

Card, QR and mobile methods also process personal data, at a lower risk level. Give employees a privacy notice explaining what data is kept, why and for how long. In mobile apps, collect location only at clock in and clock out, never continuously during working hours. Limit access to records to people who need it for their role.

For VERBİS (the Data Controllers' Registry) registration duties and exemptions, check the current thresholds in the Authority's official announcements. When setting retention periods, balance the 5 year limitation period for wage claims against data minimisation, and write the result into your retention and destruction policy.

How do you configure shifts and rules?

A PDKS adds value by processing raw clock data with the right rules. At minimum, define:

• Shift start and end times, break length and whether breaks are paid
• The weekly plan (for example 8 hours Monday to Friday and 5 hours Saturday, 45 hours in total)
• The weekly rest day: employees must have at least 24 hours of uninterrupted rest in each 7 day period
• Night work: work between 20:00 and 06:00 may not exceed 7.5 hours
• The public and religious holiday calendar
• Whether early arrival and late departure count as overtime (usually only with an approved request)
• The correction flow for missing punches (only in or only out)

For more on rotas, see the shift scheduling guide.

How do you calculate working time from clock records? (example)

In this example the employee's plan is Monday to Friday 09:00 to 18:00 (1 hour break, 8 hours a day) and Saturday 09:00 to 14:00 (no break, 5 hours), 45 hours a week. Company policy: punches before shift start do not count; time after shift end counts only with an approved overtime request. A 2 hour overtime request was approved for Monday.

The weekly total is 47 hours, so the 2 hours above 45 are overtime. For an employee on a gross monthly salary of TRY 60,000, the hourly rate is 60,000 / 225 = TRY 266.67, the overtime hourly rate is 266.67 × 1.5 = TRY 400.00 and overtime for this week is 2 × 400.00 = TRY 800.00. Make sure grace and rounding rules do not work against the employee: if late arrivals are rounded down, approved overtime should still be counted on actual time worked. You can check results with the overtime calculator.

How do you set up a PDKS step by step?

1. Policy and rules: Write down working time, breaks, grace periods, overtime approval and missing punch rules.
2. KVKK preparation: Choose the method, update the data inventory and prepare the privacy notice; biometrics are not permitted for working time tracking (KVK Board decision 2026/921), so plan card, PIN, QR code or mobile clock in.
3. Infrastructure: Install devices, QR points or mobile geofences; test how records are kept during network or power outages.
4. Master data: Load employees, locations, departments and shift definitions.
5. Pilot: Run a two to four week pilot at one site and compare records with a manual log.
6. Timesheet and payroll integration: Test how PDKS output flows into the timesheet and payroll.
7. Training and communication: Explain the rules, correction requests and how to raise objections to employees and managers.
8. Rollout and monitoring: Extend to other sites; track missing punch rates and correction times monthly.

How does PDKS data feed the timesheet?

Raw clock data is only one input to the timesheet (puantaj). The timesheet also combines leave, sick notes, public holidays and approved overtime. After manager approval at month end, it goes to payroll. For the full flow with a worked example, see how to prepare a timesheet in Turkey, and check current statutory figures on the payroll parameters page.

What are common mistakes in PDKS projects?

• Buying devices before writing the rules, and leaving rules to device defaults
• Continuing to use fingerprint or face recognition for attendance on the grounds that employees have consented
• Tracking location continuously in the mobile app
• Fixing missing punches in bulk at month end without documentation
• Counting all time after shift end as overtime without approval, or ignoring it entirely
• Copying data by hand between PDKS and payroll