With the Personal Data Protection Board’s (“Board”) “Principle Decision Regarding the Processing of Biometric Data for Time and Attendance Tracking Purposes” dated 29.04.2026 and numbered 2026/921 (“Principle Decision”), published in the Official Gazette dated 02.06.2026 and numbered 33268, the principles regarding the processing of special categories of personal data through the use of biometric identification systems such as fingerprints, facial recognition, iris/retina scanning, vein prints and similar systems for the purpose of time and attendance tracking have been evaluated.
In summary, in the Principle Decision;
• It was stated that, within the scope of the Law on the Protection of Personal Data No. 6698 (“Law”), biometric data are special categories of personal data and that, since it is not possible to change or retrieve such data if they are obtained, they require stricter protection.
• While it was accepted that the employer has an obligation to monitor and document working hours under the Labor Law and the relevant legislation, it was assessed that there is no provision expressly prescribing that time and attendance tracking be carried out through the processing of biometric data.
In this context, the Board has decided that;
• Under current circumstances, conducting time and attendance tracking by means of processing biometric data cannot be regarded as a condition expressly prescribed by law,
• Taking into account the imbalance of power in the employer-employee relationship and the revocability of consent, explicit consent alone would not constitute a sufficient legal basis,
• Where less intrusive alternative methods are available, the processing of biometric data for time and attendance tracking purposes would not satisfy the proportionality criterion under Article 4 of the Law, even if the data subject has explicit consent,
• Therefore, time and attendance tracking should be ensured through alternative methods such as password-protected cards, PIN-based systems, traditional signatures and paper-based attendance sheets, RFID/NFC identity cards or manual entry under the supervision of an auditor, instead of biometric identification systems.
You may access the full text of the Principle Decision published in the Official Gazette on 02/06/2026 from here.
Sincerely,
Balay, Eryigit & Erten Attorney Partnership
