On 27 August 2026 Turkey's data protection authority, KVKK, published a public announcement clarifying Principle Decision No. 2026/921. The Board adopted the decision on 29 April 2026, and the Official Gazette published it on 2 June 2026. It is a serious piece of rights-protective regulation, and it is deliberately narrow. The most contested biometric use in Turkey, face recognition in public spaces, sits in the gap it leaves.
What the decision actually does
The Board's reasoning on workplace attendance is persuasive. Biometric data is a special category under Article 6 of Law No. 6698. Employers usually rely on explicit consent, but KVKK's June notice says the power imbalance between employer and employee makes it doubtful that such consent is freely given. It adds that no explicit law requires biometric attendance tracking, and that even valid consent cannot rescue a practice that fails the necessity, proportionality and data-minimisation tests. The Board points to cheaper alternatives: encrypted cards, PINs, RFID/NFC cards, signature sheets and supervised manual entry.
This is the proportionate approach. It does not ban biometrics. It asks whether a less intrusive tool does the job, and for clocking in, it plainly does. A pro-innovation reading welcomes that clarity. Vendors can build products around a known rule, and employers are spared guessing at the consent doctrine.
What the August clarification adds
According to KVKK's 27 August announcement, four points stand out:
- Narrow scope. The decision covers attendance tracking only. Other biometric uses are not presumed lawful or unlawful. Controllers must assess them themselves, and the Board reviews complaints case by case.
- Access control is treated differently. Systems used for identity verification and access to critical areas in higher-risk facilities may be assessed differently. They must be limited to the necessary areas and people, alternatives must be inadequate, and the measure must fit a concrete security need.
- Codes are still biometric data. Converting a fingerprint or palm scan into a mathematical code and storing it does not remove its biometric character. The Authority draws on GDPR Recital 51 because Turkish law has no comprehensive definition.
- The security exemption is not a blank cheque. Article 28(1)(ç) can take processing for national defence, national security, public safety, public order or economic security outside the Law. The Authority says this does not permit unrestricted biometric use, and each case needs an assessment of the risk, the adequacy of alternatives and the purpose.
The last point is the most interesting. KVKK is saying that the exemption has limits and that it will look at how it is used. That is a more assertive reading than a bare exclusion would imply.
The steelman for the carve-out
The strongest case for the exemption is that security agencies cannot publish their methods, that regulators lack operational expertise, and that dangerous suspects can be found faster with facial matching. A data protection authority second-guessing an investigation in real time would be neither practical nor, many would argue, appropriate. Most democracies have some version of this carve-out.
Where the gap is
The announcement does not mention public spaces. Yet the evidence suggests that is where the scale lies. New Lines Magazine reported in June 2025 that police reports showed more than 100 young people captured by police cameras, most simply standing in crowds. It documented purchases of 3,500 cameras in September 2024 and a tender for 13,000 on 18 March 2025. It also noted that there is no transparency about how the technology is used to police protests. It stressed that it could not confirm that facial recognition identified the protesters in those specific cases. Follow the Money reported that the tender for up to 13,000 additional facial recognition cameras came out just days before the March 2025 protests, and that lawyers question how transparent the deployment is.
The contrast is stark. An employer who wants a fingerprint reader at the factory gate has to defend it on necessity grounds. A police force deploying thousands of cameras that can recognise faces in crowds is, on the face of the exemption, in a different regulatory universe. The same biometric template is treated as dangerous in one context and exempt in the other.
KVKK's own logic points to a way through. If the Article 28(1)(ç) exemption is bounded by seriousness of risk, adequacy of alternatives and purpose, then those are the questions a court or oversight body should ask of mass public-space identification. Using face matching to find a named suspect in a serious crime is a different proposition from retrospectively identifying lawful protesters, which the Turkish bar has questioned. As the New Lines piece records, the Istanbul Bar Association's Hürrem Sönmez said, "We do not consider those photographs to be legally admissible evidence."
What a proportionate regime would look like
None of this requires banning police use of the technology. It requires four modest things that the workplace decision already models:
- A published legal basis that names the purpose, rather than relying on a general exemption.
- A necessity test showing why less intrusive means are inadequate.
- Independent, after-the-fact review, whether by KVKK, a court or a parliamentary body, with access to logs.
- Public reporting of procurement and deployment scale, so that citizens know what exists.
These rules would also serve innovation. Domestic and foreign vendors of recognition systems face uncertainty and reputational risk when no rules exist for the largest market, the state. Clear limits help legitimate uses survive scrutiny.
Bottom line
KVKK has done what a regulator can do inside its remit: it has closed off an unnecessary workplace intrusion and signalled that the security exemption is bounded. The harder question is whether anyone will enforce those bounds against police cameras. Until a public-space rule exists, Turkey regulates the time clock more strictly than the street.