Fingerprint and facial recognition attendance tracking banned: KVKK Principle Decision 2026/921
Fingerprint readers and facial recognition terminals, long used routinely in workplaces, have now become a direct compliance risk. The Personal Data Protection Board’s Principle Decision on…
⏱️ Reading time: 9 min · 📁 Category: KVKK, Digital Compliance and Data Security
Fingerprint and facial recognition attendance tracking banned: KVKK Principle Decision 2026/921
Fingerprint readers and facial recognition terminals, long used routinely in workplaces,
have now become a direct compliance risk. The Personal Data Protection Board’s
Principle Decision on Processing Biometric Data for Attendance Tracking, dated 29 April 2026 and numbered 2026/921,
entered into force upon publication in Official Gazette No. 33268 of 2 June 2026.
The decision’s effect can be stated in one sentence: even if the employee has given explicit consent,
processing biometric data for attendance tracking (PDKS) is unlawful.
This means that the defense that "I have received approval from my staff" is no longer valid.
All businesses and public bodies using fingerprints, facial recognition, iris or retina scans for attendance tracking are covered.
Explicit consent alone is insufficient as a legal basis. Attendance must be tracked using encrypted cards, PINs, RFID/NFC cards, signature sheets or mobile/QR systems as
less intrusive methods.
Non-compliance with the decision may lead to proceedings for an administrative fine under Article 18 of KVKK.
What is the Legal Basis of the Principle Decision?
Fingerprints, facial recognition, iris and retina data are considered
special categories of personal data under Personal Data Protection Law No. 6698. These data uniquely identify a person and
cannot be reversed once compromised; they therefore require the highest protection level.
Although attendance legislation contains provisions on recording working hours, the Board found
that using biometric data for this purpose had no explicit statutory basis.
The decision relies on the Constitutional Court ruling that fingerprint attendance tracking violated rights because it failed the legality requirement, and
on Council of State case law finding palm-vein readers contrary to proportionality.
The principle decision made this judicial approach binding at the administrative level too.
Many businesses based biometric attendance systems on employees’ explicit consent. The Board rejected this approach on two grounds.
Invalidity Reasons- Power imbalance: Employees who fear losing their jobs have limited freedom to say no, casting doubt on freely given consent.
- Withdrawability: If an employee withdraws consent, continuity of the system is disrupted, making consent a weak basis from the outset.
- Proportionality: Choosing the most sensitive method despite less intrusive alternatives violates the purpose-related, limited and proportionate processing principle in Article 4.
The decision clarifies which attendance methods pose risks and which alternatives can replace them.
Comparison of attendance tracking methods| Category | Method | Status for attendance tracking |
|---|---|---|
| Biometric | Fingerprint, facial recognition, iris, retina | ❌ Illegal (even with explicit consent) |
| Card / Code | Encrypted card, PIN-based systems | ✅ Suitable |
| Contactless Card | RFID / NFC ID cards | ✅ Suitable |
| Manual | Signature chart, manual entry under supervision of the auditor | ✅ Suitable |
| Mobile | QR-code or location-based mobile attendance system | ✅ Suitable, provided no biometric data are collected |
The decision directly binds the private sector and public institutions and organizations.
All controllers using biometric attendance tracking are covered, from factories and office complexes to municipalities and hospitals.
It is wrong to think “We are a public institution or small business, so this does not concern us.”
The decision covers everyone processing biometric data for attendance tracking, regardless of size or sector.
Yes, but they are limited. The ban concerns routine attendance tracking (PDKS).
In areas that require high security, such as a bank vault, R&D lab, data center, or critical server room,
biometric data may be considered solely to limit access to authorized personnel, after separately assessing purpose and necessity.
In this case, even the legal framework and a rigorous analysis of necessity are essential.
The Board regards non-compliance with the decision as a breach of the technical and administrative safeguards obligation under Article 12 and
announced that administrative sanctions would apply under Article 18.
KVKK administrative fines rise annually with the revaluation rate; for this category, the 2026 maximum can reach
millions of Turkish lira, around TRY 17 million.
More critically, this risk is often triggered by a single employee complaint leading to an ex officio inspection.
- Entry and exit: facial-recognition terminal
- Basis: employee explicit consent
- Result: Explicit consent is insufficient, so a compliance risk exists and a switch to an alternative system is required.
- Staff attendance tracking: fingerprint
- Institution type: public
- Result: The practice must be revised immediately because the decision also binds public bodies.
- Purpose: only authorized entry into critical laboratory
- Scope: access control, not routine attendance tracking
- Result: An exception may be considered, but a necessity analysis and statutory framework are required.
If you are already using biometric PDKS, managing the transition in the following order is the safest approach:
- Detection: Identify which employees’ biometric data are held and what data are involved.
- Inventory update: Record the current processing activity and its basis.
- Switch to an alternative system: Switch to card/PIN, RFID/NFC, QR or mobile PDKS.
- Biometric data disposal: Irreversibly delete or anonymize data that no longer have a legal basis.
- Disposal record: Document the disposal process; this is the most important evidence protecting you during an inspection.
- Update privacy information and consent: Prepare privacy notices and employee information suited to the new system.
- VERBİS update: Reflect the processing change in the system within the applicable period.
Changing the device alone is insufficient. Unless previously collected biometric data are properly destroyed
and the process documented in a record, even after the system changes, the risk from past violations remains.
KVKK Principle Decision 2026/921 clearly marks the end of biometric attendance tracking.
“Everyone uses it” or “I obtained employees’ consent” no longer provide legal protection.
Companies must manage this as a compliance project covering inventory, disposal, privacy notices, consent and VERBİS
together, rather than merely replacing a device. Otherwise, a single employee complaint
may directly trigger administrative fine proceedings.
At B10 Digital Agency, we map risks in your existing fingerprint/facial recognition system,
plan migration to a compliant alternative and establish inspection-ready documentation.
Through our hybrid model combining legal advisers and technical teams, we manage biometric data disposal,
data inventories, privacy notices and VERBİS updates in one workflow.
Your existing PDKS infrastructure and biometric data items collected are analyzed. 🗑️ Documented Disposal
Data without a continuing legal basis are disposed of with a documented, inspection-ready record. ⚖️ Compliance action plan
Alternative systems, privacy information and VERBİS steps become a roadmap.
If you track attendance with fingerprints or facial recognition, conduct a compliance analysis before an employee complains.
Request a biometric PDKS compliance analysis
Yes. The Board considers explicit consent insufficient for attendance tracking because of the employer–employee power imbalance and proportionality principle.
What alternative methods are lawful?Encrypted cards, PIN systems, RFID/NFC ID cards, traditional signature and paper sheets, QR/mobile PDKS and supervised manual entry.
Can I use fingerprints in high-security areas?The ban concerns routine attendance tracking. For access to critical areas such as R&D labs, server rooms or vaults, use may be possible within the statutory framework after separately assessing purpose and necessity.
What should I do with old biometric data?Delete or anonymize data that no longer have a legal basis under the Data Disposal Policy and document the process in a record.
Does the decision also cover public bodies?Yes. Both the private sector and public institutions and organizations are covered.
Sources and related documents
These documents provide references for the methods and rules discussed in this article.