How Long Can CCTV Recordings Be Retained Under KVKK?

⏱️ Reading time: 10 min · 📁 Category: KVKK & Digital Compliance

How Long Can CCTV Recordings Be Retained Under KVKK? (Detailed Guide)

The use of camera recording systems in workplaces, residential complexes, shopping centres, hotels, factories and offices
is considered, under KVKK, personal data processing. Therefore, the
retention period for recordings must be based on legal principles and proportionality to the purpose rather than arbitrary decisions.

This article explains the retention period for camera recordings under KVKK, the Board’s approach and the limits applied in practice
in detail.

📌 Are Camera Recordings Personal Data Under KVKK?

Yes. Camera recordings can contain a person’s physical appearance, behaviour and sometimes location information
and therefore qualify as personal data. In some scenarios, there may also be
consequences that indirectly affect special categories of personal data.

Therefore, camera systems are primarily subject to the following provisions:

• KVKK Art. 4 (General Principles)
• KVKK Art. 5 (Legal Basis)
• KVKK Art. 10 (Duty to Inform)
• KVKK Art. 12 (Data Security)

✅ Is Explicit Consent Required for Camera Recording Under KVKK?

As a general rule, no. Camera recordings are usually based on:

• Legitimate interest
• Ensuring safety
• Protection of rights

as legal bases. However, the following practices are unlawful and, even with explicit consent,
cannot be legitimised:

• Use of hidden cameras
• Continuous monitoring/performance monitoring of employees
• Monitoring outside the stated purpose and using recordings for other purposes

💡 Practical Takeaway: Even if the legal basis is correctly selected when installing the camera system,
an incorrectly designed scope (areas filmed), duration (days retained) or access policy (who can view recordings)
makes the process contrary to KVKK. 🗓️ According to KVKK, how many days can camera recording be stored?

🔑 Short Answer: “For as long as necessary.”

KVKK does not specify a fixed number of days for camera recordings (such as 7, 30 or 90 days).
However, Board decisions and practice have clarified the approach based on a reasonable period.
The decisive principles here are proportionality to the purpose and limitation of the retention period.

📊 Retention Periods Accepted in the Board’s Practice

The following periods are common in practice and are considered "reasonable" in most scenarios.
However, these ranges do not confer automatic rights ; each organisation must provide its own justification.

Setting / Purpose	Accepted Time in Practice	Note
Office / Workplace	7 - 30 days	Limited to entry/exit control and incident detection; access must be restricted
Shopping centre / Residential complex / Apartment building	15 - 30 days	Common-area security; warning signs and access to the privacy notice are required
Factory / Warehouse	30 days	Occupational health and safety and asset protection; blind spots and coverage must be carefully planned
School / Educational institution	7 - 14 days	Children’s data is sensitive; keep retention short and select monitored areas carefully
Hotel	30 days (except in exceptional circumstances)	After an incident or complaint is identified, only the relevant recording may be retained longer

⚠️ Important: These periods are not a standard. The Board’s approach requires
purpose, risk, area, access and the deletion mechanism to be assessed together. ⏳ Is It Possible to Store Longer?

Yes, but conditional. In the following cases, records may be stored for longer:

• If a judicial or administrative investigation has been initiated
• If an incident has been identified and the recording has become evidence
• If a court, public prosecutor or law enforcement authority requests it

The basic rule in this case is: Only the relevant recording is retained.
The duration of all records cannot be extended automatically.

🧩 Principles to be applied to Camera Recordings according to KVKK 1️⃣ Purpose Limitation

Camera recordings may only be used for security, entry/exit control and incident detection.
Monitoring for other purposes (such as employee performance) carries a high risk under KVKK.

2️⃣ Data Minimization

• Blind spots should not be monitored; only required areas should be monitored.
• Private areas such as toilets, changing rooms and rest areas must never be monitored.
• Sound recording is, as a rule, high-risk; in most scenarios, it leads to illegality.

3️⃣ Limited Time

• At the end of the specified period, recordings must be automatically deleted or overwritten.
• Keeping recordings “just in case” is not a valid justification.

4️⃣ Transparency and the Duty to Inform

Areas under camera surveillance must have visible warning signs and
data subjects must have access to the privacy notice.

📌 Minimum Compliance Measures:
Warning signs, a privacy notice, a retention period, access permissions and a deletion procedure must be designed together. ♻ Should Camera Recordings be Auto-Deleted?

Yes. Under KVKK, systems that rely on manual deletion carry a high risk.
Automatic deletion or overwriting should be preferred, and deletion operations should, where possible, be logged.

⚠️ What happens if the camera recordings are not deleted?

The following situations pose a risk of violations in terms of the KVKK:

• Expired records continue to be stored
• Unnecessary archiving of records
• Unauthorised access or sharing

These situations may result in an administrative fine, a Board order for destruction and, in some cases,
the Board’s decision being publicly disclosed.

🗂️ Are Camera Recordings Reported to VERBIS?

Yes. Camera recordings must typically be entered as follows:

• Data category: Visual data
• Processing purpose: Ensuring security
• Retention period: Must be clearly specified

These details must be entered in VERBİS if the organisation is subject to a VERBİS registration obligation.

❌ Common Mistakes

• Unjustified retention on the assumption that “30 days is standard”
• Using cameras with audio recording
• Continuous monitoring of employees
• Failure to provide the required privacy information
• No automatic deletion mechanism

✅ Result: Camera Recording Time Is Determined by Principle, Not by Number

Under KVKK, camera recordings must be specific, legitimate, proportionate and time-limited
. The Board’s practical approach rests on the following principle:

"Every extra day that is not necessary is a violation." 🔍 Does Your Camera System Comply with KVKK?

Camera retention periods, the privacy notice, VERBİS registration and the deletion policy must be considered together.
Contact us for support with KVKK compliance analysis, retention and destruction policies, and privacy notices for camera systems.

Request a KVKK Compliance Analysis for Camera Systems