The Board’s 2026 decision on biometric attendance
Principle Decision 2026/921, dated 29 April 2026 and published in the Official Gazette on 2 June 2026, addresses fingerprint, face, iris and similar systems used to record working hours.
The Board found that no Turkish law requires or expressly permits biometric time-keeping, so the “clearly provided for by law” condition in Article 6 cannot apply. It doubted whether explicit consent can be freely given between employer and employee, and concluded that even valid consent would not make biometric attendance proportionate under Article 4 while less intrusive methods exist. The alternatives it named are encrypted card or PIN systems, RFID and NFC identity cards, paper attendance sheets and supervised manual entry. Employers that do not follow the decision face fines under Article 18.
A KVKK announcement on 27 August 2026 confirmed that storing a fingerprint or face as a mathematical template does not stop it being biometric data. It also confirmed that the decision covers attendance only. Biometrics used to control access to critical areas at high-security sites are assessed case by case, must be limited to the areas and people that need them, and require alternatives to be insufficient. Using the same biometric data to record attendance could bring it back within the decision.
What KVKK requires for any attendance system
- Biometric data is special-category personal data under Article 6 and may be processed only on one of the conditions listed there, with the Board’s additional security measures.
- A privacy notice (aydınlatma metni) must be given when data is collected (Article 10).
- Controllers must register in VERBIS unless they have fewer than 50 employees and an annual balance sheet under TRY 100 million. Lower thresholds apply where processing special-category data is the main activity.
- Data held outside Türkiye, including in a cloud service hosted abroad, is a transfer under Article 9. It needs an adequacy decision or a safeguard such as the Board’s standard contract, notified within five business days of signing.
- Data must be deleted, destroyed or anonymised once the purpose for processing ends (Article 7).
Fines and penalties
| Breach | Fine range for 2026 |
|---|---|
| Data security failures, including unlawful processing (Article 12) | TRY 256,357 to 17,092,242 |
| Not complying with Board decisions | TRY 427,263 to 17,092,242 |
| VERBIS registration and notification | TRY 341,809 to 17,092,242 |
| Failing to inform employees (Article 10) | TRY 85,437 to 1,709,200 |
The ranges rise every January with the revaluation rate. In 2025, the KVKK fined 594 controllers more than TRY 216 million in total for missing VERBIS deadlines. Unlawfully recording personal data is also a criminal offence under Article 135 of the Turkish Penal Code, carrying one to three years’ imprisonment.
What employers in Türkiye should do now
- Identify any attendance process that uses biometrics, including systems that store only templates.
- Move attendance to a non-biometric method, such as RFID cards or supervised manual entry.
- Delete biometric data held for attendance, as Article 7 requires once there is no basis for keeping it.
- Document any remaining biometric use. Where biometrics control access to critical areas, record why alternatives fall short, and keep that data out of timesheets and payroll.
- Update your privacy notices and VERBIS entries to reflect the change.
Free template: Download the free retention-policy template →
How NCheck supports it
NCheck runs non-biometric attendance on the same account as face, fingerprint and iris, using RFID cards or barcodes, with manual check-in as a fallback. Turkish sites can record working hours without biometrics and reserve biometric access control for the critical areas where it can be justified.
- On-premises deployment keeps any biometric data on your own servers, so it does not leave Türkiye.
- Encrypted, non-reversible templates, and event photos deleted automatically after a period you set.
- Deletion tools and audit logs to support erasure under Article 7.
Common in these industries
Manufacturing · Retail · all industries
Frequently asked questions
Is biometric attendance lawful under KVKK?
Under Principle Decision 2026/921, published in June 2026, the Board treats biometric processing for tracking working hours as unlawful, even with employees’ explicit consent, because less intrusive methods such as cards and PIN systems are available.
Does the decision apply if only templates are stored?
Yes. The KVKK confirmed in August 2026 that converting a fingerprint or face into a mathematical template does not remove its status as biometric data.
Can we still use biometrics for access control?
The decision covers attendance only, so access control at sites with a real security need is assessed case by case. It should be limited to the critical areas and people that need it, backed by a written assessment of why alternatives fall short, and kept separate from attendance records.
Do we need to register in VERBIS?
Yes, unless you have fewer than 50 employees and an annual balance sheet under TRY 100 million, with lower thresholds where special-category data is your main activity. Your registration records processing purposes, retention periods and transfers, so update it when your attendance method changes.
This page is general guidance, not legal advice. Laws change; confirm current requirements with your counsel.
Deploy it the compliant way
Run NCheck fully on your own server — data never leaves your network — or in NCheck Cloud. Either way, matching uses encrypted templates, and event photos can be deleted automatically after a period you set. About on-premises → · Security & compliance →