Protection of Personal Data in the Employment Relationship

In the employment relationship, the employer processes employees' personal data extensively – from application and personnel data to salary, performance and health data, and from camera recordings to corporate communication data. However, there is no uniform compliance model for the protection of employee data that can be applied to every employer. The company's field of activity, its organisational structure, the employees' duties, the technologies used and the data flows directly affect which data may be processed and under which conditions. The notion that data protection compliance is a matter that can be resolved with standard texts is therefore misleading: a data processing activity that is lawful for one company may not lead to the same result for another company.

Under Law No. 6698 on the Protection of Personal Data (KVKK), which was brought closer to the European General Data Protection Regulation on important points by the legislative amendments of March 2024, the lawful processing of employee data is a compliance task that must be assessed continuously on the basis of the company's own processes, in particular for international companies using group-wide personnel systems.

Contents

• Which employee data are covered by data protection?
• Which general principles apply to every data processing operation?
• On which legal grounds can processing be based?
• What special rules apply to special categories of personal data?
• What is the significance of explicit consent in the employment relationship?
• What applies to monitoring and control measures at the workplace?
• Which information, registration and security obligations bind the employer?
• What applies to the transfer of employee data abroad?
• How are retention, erasure and data subject rights regulated?
• What are the consequences of breaches?
• Conclusion

Which employee data are covered by data protection?

Personal data means any information relating to an identified or identifiable natural person. In the employment relationship, this covers virtually all personnel information: identity and contact data, CVs and references, salary, bank account and tax data, attendance, performance and disciplinary data, location and vehicle data, photographs and logs of the use of corporate computers and systems. Protection begins as early as the recruitment process and continues after the end of the employment relationship – for example in the retention of personnel files and in responding to requests for information.

As a rule, the employer is the data controller with regard to employee data. Whether third parties providing payroll, recruitment, cloud, travel or occupational health and safety services are data processors or independent data controllers must be determined separately, depending on who determines the purposes and means of the processing. Data sharing between separate legal entities within the same group of companies is not automatically regarded as "internal" either; it is assessed as a transfer under Article 8 KVKK and, where applicable, Article 9 KVKK.

Which general principles apply to every data processing operation?

Every processing operation must comply with the general principles set out in Article 4 KVKK:

• Lawfulness and fairness (compliance with the rules of good faith)
• Accuracy and, where necessary, being kept up to date
• Processing for specified, explicit and legitimate purposes
• Being relevant, limited and proportionate to the purpose (data minimisation)
• Retention for the period prescribed by the legislation or necessary for the purpose

These principles are the yardstick for the lawfulness of every data processing activity, from the selection of candidates to performance evaluations and the transfer of data to third parties.

How these principles are to be applied, however, must be assessed separately for each data processing activity. The processing of the same employee data may be necessary and proportionate to the purpose at one workplace, while being unnecessary or disproportionate at another. The compliance assessment must therefore be based not only on the type of data processed, but on the purpose for which and the conditions under which the company processes those data.

With regard to employee data, Article 419 of the Turkish Code of Obligations and Article 75 of the Labour Law must also be taken into account in addition to the KVKK. The employer may use the employee's personal data only to the extent that they relate to the employee's suitability for the job or are necessary for the performance of the employment contract; it must use the information in the personnel file in accordance with the rules of good faith and the law and must not disclose information which the employee has a legitimate interest in keeping confidential.

On which legal grounds can processing be based?

The processing of personal data is lawful if one of the conditions listed in Article 5 KVKK is met. Where one of the following conditions is met, the employee's personal data may be processed without the employee's explicit consent:

• Processing is directly related to and necessary for the conclusion or performance of the employment contract – for example the processing of bank account details for the payment of wages or of transport and accommodation details for a business trip
• Fulfilment of the employer's legal obligations – for example notification and retention obligations relating to social security, tax and OHS
• Processing is expressly provided for by law – for example keeping the employee's identity details and the documents and records required by law in the personnel file pursuant to Article 75 of the Labour Law
• Processing is necessary for the establishment, exercise or protection of a right – for example the retention of personnel and performance records required for the defence in an employment dispute, or their submission to the court
• Processing is necessary for the legitimate interests of the employer, provided that it does not harm the employee's fundamental rights and freedoms – for example keeping records of security incidents in corporate systems after the employer's need for information security and the employee's rights relating to the protection of his or her personal data have been weighed against each other and it has been concluded that the impact of record-keeping on the employee is proportionate
• Processing is necessary to protect the life or physical integrity of a person who is unable to give consent due to actual impossibility or whose consent is not legally valid, or of another person – for example sharing the identity and contact details of an unconscious employee required for emergency medical intervention with the medical team
• The employee has made the data public – the processing must be consistent with the employee's intention and purpose in making the data public.

What special rules apply to special categories of personal data?

Data relating to employees' race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, are special categories of personal data and enjoy enhanced protection.

The amendment that entered into force on 1 June 2024 restructured and extended the conditions for processing special categories of personal data. In addition to explicit consent, these data may be processed where processing is expressly provided for by law, where it is necessary for the establishment, exercise or protection of a right, or where it is necessary for the fulfilment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance. The other processing conditions are exhaustively listed in Article 6 KVKK.

Health data may also be processed by persons subject to a duty of confidentiality or by authorised institutions and organisations where this is necessary for the protection of public health, preventive medicine, medical diagnosis, the provision of treatment and care services, and the planning, management and financing of health services. This provision may provide a basis for the processing of the necessary health data by the workplace physician; the employer, by contrast, as a rule needs access not to the detailed diagnosis and medical file, but only to the necessary conclusion regarding the employee's fitness for work.

For example, occupational health and safety records that must be kept by law, health surveillance carried out by the workplace physician and mandatory records relating to the employment of persons with disabilities may be processed without explicit consent if the specific conditions are met. In every case, however, the general principles in Article 4 KVKK must be observed and the additional security measures laid down in the Board's Decision No. 2018/10 must be taken.

What is the significance of explicit consent in the employment relationship?

In practice, one of the methods most frequently used by employers in their personal data processing procedures is to obtain explicit consent from employees that is as broad as possible. It is quite common for various forms to be put in front of employees on joining, for numerous documents to be added to the personnel file and for different data processing activities to be bundled under a single "explicit consent text". Behind this there is often the following idea: "If we have obtained the employee's explicit consent, we can process the personal data."

In personal data protection law, however, explicit consent is not a general authorisation mechanism that renders every data processing activity of the employer lawful. Indeed, in the context of the employment relationship, relying on explicit consent should often not be the first option, but an exceptional legal basis that requires careful assessment. This is because the structural imbalance of power between employer and employee in itself raises a question as to whether the consent given by the employee is genuinely based on free will.

Explicit consent is an affirmative declaration of intent relating to a specific matter, based on information and given freely, and it may be withdrawn where necessary. If an employee who does not give explicit consent or who withdraws consent suffers adverse consequences, this casts doubt on whether the consent was freely given. The employee's signature alone therefore does not render the data processing activity lawful.

The duty to inform and explicit consent procedures must be kept separate. The employee must be informed about the data processing activity regardless of the legal ground on which his or her personal data are processed. Where processing is based on explicit consent, consent must be obtained separately from the information notice; where another processing condition exists, explicit consent should not be requested.

Since each company's activities, employees' duties and data processing procedures differ, the legal assessment must be made according to the specific circumstances of the case. For example, a criminal record should be requested only if it is necessary and proportionate in view of the position and the sector and if, in addition, one of the processing conditions listed in Article 6 KVKK is met. If these conditions are not met, obtaining explicit consent does not in itself render the data request lawful.

Similarly, information unrelated to the job, such as health habits, should not be included in the personnel file on the basis that it "might be needed in the future". The employer must be able to demonstrate in advance the connection of the data request with suitability for the job or the performance of the employment contract, as well as its necessity and proportionality.

According to the Board's Principle Decision No. 2026/921 dated 29 April 2026, the processing of biometric data such as fingerprints, facial recognition, iris or retina scans for the purpose of working time recording is contrary to the principle of proportionality where less intrusive alternative methods are available; it does not become lawful even if valid explicit consent has been given. Working time recording must be ensured by means of card or PIN-based systems, RFID/NFC identity cards, signature sheets or similar alternatives.

Finally, explicit consent cannot be obtained from the employee in a general and vague form covering all data processing activities that may be carried out in the future. General "blanket consents" given without clearly stating which personal data will be used, for what purpose and in the context of which processing activity are not regarded as valid.

What applies to monitoring and control measures at the workplace?

Camera surveillance, monitoring of corporate e-mail and internet use and location tracking systems may be implemented only subject to the conditions of a specific and legitimate purpose, an appropriate legal ground, prior information, necessity and proportionality. The case law of the Constitutional Court on corporate e-mails requires clear information on the purpose, scope, method and possible consequences of the monitoring, consideration of less intrusive means and a fair balance between the employee's reasonable expectation of privacy and the employer's interest. Where clear information has been provided, it is, as a rule, not necessary to obtain separate explicit consent before each review.

According to the announcement on workplace cameras published by the Personal Data Protection Authority in 2026, cameras must be used only for specific, predetermined purposes such as workplace security or occupational health and safety and must not be directed at monitoring productivity or discipline in the abstract. Private areas such as toilets, changing rooms, prayer rooms and rest areas must not be monitored; the camera angle, audio recording, access rights and retention period must also be restricted. Covert surveillance may be considered only under very exceptional conditions. In addition to sanctions under the data protection legislation, unlawful surveillance also calls into question the admissibility of the recordings as evidence in an employment dispute and the validity of a termination based on them.

Which information, registration and security obligations bind the employer?

When personal data are obtained, the employer must inform employees clearly and comprehensibly about the identity of the data controller, the purposes of processing, the recipients of transfers and the purposes of transfer, the method of collecting the data and the legal grounds, and their rights under Article 11 KVKK. The purposes of processing and the legal grounds must be stated specifically; general and vague wording must be avoided, and information notices must be updated whenever processes change.

Employers subject to the registration obligation must also register with VERBİS (the Data Controllers' Registry Information System) and prepare a personal data processing inventory and a personal data retention and destruction policy. Under the current exemption criteria, data controllers whose main activity is not the processing of special categories of personal data and whose annual number of employees is less than 50 and whose annual balance sheet total is less than TL 100 million, as well as data controllers whose main activity is the processing of special categories of personal data but whose annual number of employees is less than 10 and whose annual balance sheet total is less than TL 10 million, are exempt from the VERBİS obligation, without prejudice to other exemptions. Both thresholds must be met cumulatively. This exemption does not remove the other obligations under the KVKK.

Employers processing special categories of personal data must, pursuant to the Board's Decision No. 2018/10, establish a separate security policy and procedure specific to such data. All data controllers must, in line with Decision No. 2019/10, prepare a data breach response plan setting out the procedure to be followed in the event of data breaches and review this plan at regular intervals.

The employer must also take appropriate technical and organisational measures, such as access authorisation, strong authentication, encryption, secure record-keeping and logging, training and confidentiality obligations, and carry out the necessary audits. A personal data breach must be notified to the Board without delay and at the latest within 72 hours from the date on which it becomes known, and to the persons affected by the breach as soon as reasonably possible after they have been identified. If, for a justified reason, notification cannot be made within 72 hours, the reasons for the delay must also be explained to the Board.

KVKK compliance must be assessed not only by reference to the Law, but also by reference to the relevant regulations and communiqués, the Board's principle decisions and other decisions, guidelines and the current practice of the Authority. The texts and policies prepared must be consistent with the company's actual data processing procedures and must be updated where necessary.

What applies to the transfer of employee data abroad?

The legislative amendment of 2024 substantially changed the regime for transfers of data abroad. In particular, the employee's explicit consent is no longer a general basis for regular and continuous transfers abroad. Explicit consent may be used only where there is no adequacy decision and no appropriate safeguards, as one of the incidental transfer cases exhaustively listed in the Law. Structural transfers such as central HR systems, cloud services abroad used on a continuous basis or regular data access by group companies therefore cannot be based on explicit consent.

In the absence of an adequacy decision, one of the processing conditions in Article 5 or Article 6 KVKK must be met, it must be possible for the data subject to exercise his or her rights and to seek effective legal remedies in the country of transfer as well, and one of the appropriate safeguards must be provided. For the private sector, the main safeguards are the standard contracts published by the Board, binding corporate rules approved by the Board and written undertakings subject to the Board's authorisation. A standard contract does not require prior authorisation; it is notified to the Authority within five working days from the date on which the signatures are completed.

In the case of standard contracts, the correct one of the four models must be selected according to the transfer roles; the text published by the Board must not be amended except for optional or alternative clauses; the Turkish text must be signed by persons authorised to represent the parties, and the notification must be made in time together with documents evidencing the authority.

The question "Is data being transferred abroad?" should not be answered solely by reference to files sent directly by the HR department. The location of servers and access rights from abroad in payroll, human resources, performance, travel, e-mail, cloud and remote support systems, as well as access granted to group companies, must be examined on a data-flow basis. Transfers to separate legal entities within the same group of companies also constitute transfers to third parties for KVKK purposes.

How are retention, erasure and data subject rights regulated?

Employee data may be retained only for as long as statutory retention obligations or legitimate purposes require; once the grounds for processing cease to exist, they are erased, destroyed or anonymised. Data controllers subject to the obligation to register with VERBİS must have a personal data retention and destruction policy that includes periodic destruction intervals. As data subjects, employees have the right to learn whether their data are being processed, to request information if they have been processed, to learn the purpose of processing and whether the data are used in accordance with that purpose, to know the third parties to whom data have been transferred, to request rectification and, where the conditions are met, erasure or destruction and notification of these operations to third parties, to object to an adverse result arising exclusively from automated analysis, and to claim compensation for damage resulting from unlawful processing. Applications must be concluded as soon as possible and at the latest within 30 days, free of charge unless an additional cost arises. An employee whose application is rejected, who finds the response insufficient or who does not receive a response in time may lodge a complaint with the Board within the 30-day and 60-day periods set out in Article 14 KVKK.

What are the consequences of breaches?

Breaches of the obligations relating to information, data security, compliance with Board decisions, VERBİS registration and notification, and the notification of standard contracts may result in administrative fines that are revalued every year. The unlawful recording, disclosure or acquisition of personal data, or the failure to destroy them in time, may also give rise to criminal liability under Articles 135-140 of the Turkish Criminal Code. An employee whose personality rights have been infringed may claim compensation under the general provisions; administrative fines imposed by the Board may be challenged before the administrative court. The admissibility as evidence in employment disputes of recordings obtained unlawfully also raises a separate problem.

Conclusion

The protection of employee data is a continuous cross-cutting compliance task covering all personnel processes, from recruitment to the period after the end of the employment relationship. Following the 2024 amendments and the Board's 2026 Principle Decision on biometric working time recording and its announcement on workplace cameras, companies should reassess their practices regarding legal grounds and consent, flows of special categories of data, monitoring tools and mechanisms for transfers abroad.

Information notices, data processing inventories, retention and destruction policies and monitoring policies, up-to-date data flow maps and trained employees are the essential elements of a sound data protection organisation in the personnel area; in the event of an inspection or a dispute, they become decisive means of defence.

GEMS Schindhelm advises companies on the KVKK-compliant design of personnel processes, monitoring and control measures, the transfer of employee data abroad, and the defence against administrative fines and liability risks. This article is intended for general information purposes only and does not constitute a legal opinion or legal advice; each dispute must be assessed separately in light of the specific circumstances of the case and the legislation in force.