In the employment relationship, employers process a large amount of personal data about their employees. Identity details, contact details, salary records, performance information, health data and the documents in the personnel file (özlük dosyası) are among the information that must be protected as employees’ personal data.

Protecting employee data is not only a KVKK obligation; it is also one of the basic elements of the relationship of trust between employer and employee. For what purpose an employer collects employee data, how it uses it, how long it stores it and with whom it shares it are all legally important.

Under the Law on the Protection of Personal Data No. 6698 (KVKK), employees’ personal data must be processed and protected lawfully, and the necessary security measures must be taken.

Can an Employer Process Employee Data?

Employers have to process some personal data about their employees in order to establish and continue the employment relationship. However, this does not mean that the employer can collect data about the employee without limit.

The basic test for processing employee data is that the data processed is connected to the employment relationship, necessary and limited to the purpose.

For example, obtaining bank details to pay wages, or processing identity details to fulfil legal obligations, may have a legal basis. However, collecting unnecessary personal information that is unrelated to the job may cause problems under the KVKK.

Protecting Personal Data in Employee Personnel Files

Personnel files kept by employers may contain a large amount of personal data about employees. Identity details, education records, onboarding documents, leave records, salary information and other employment documents fall into this category.

The information in personnel files must be accessible only to authorised persons, stored securely and not used for any other purpose.

Employers have obligations regarding the protection of employee files under both the Labour Law (İş Kanunu) and the KVKK.

Protecting Employees’ Health Data

Employees’ health information is a special category of personal data (özel nitelikli kişisel veri) and is among the types of data that require a higher level of protection.

Pre-employment health reports, health information used in occupational health and safety processes, and health data obtained because of working conditions must be processed carefully.

The principle of data minimisation is important when processing health data. The employer should access only the health information that is genuinely necessary and should not share it with unauthorised persons.

CCTV Recordings and Employee Monitoring

Using camera systems for security purposes is common practice in workplaces. However, camera recordings also qualify as personal data.

When using cameras, employers must inform employees, define the purpose of the monitoring clearly and act in line with the principle of proportionality.

Keeping employees under constant surveillance, or monitoring them in a way that violates their private life, may lead to legal problems.

Use of Fingerprints and Biometric Data

Some workplaces may use biometric systems for entry and exit control or for security purposes. However, biometric data such as fingerprints is a special category of personal data and is subject to stricter protection.

Convenience alone is not enough to justify the use of such systems. It should be assessed whether alternative methods exist and whether the data processing is necessary and proportionate.

The Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) emphasises that particular attention must be paid to the principle of proportionality when employees’ biometric data is used.

Performance Data and Employee Tracking Systems

Employers may use various tracking systems to assess employees’ performance. However, the information obtained during performance measurement is also personal data.

Performance assessments should be based on objective criteria, employees should not be monitored unnecessarily and the data obtained should not be used for other purposes.

Sharing employees’ personal data with third parties is one of the important issues that require attention under the KVKK.

Data transfers may arise in situations such as payroll services, private health insurance, outsourced human resources services or technical system providers.

In these transfer processes, the legal basis for the data sharing, the purpose of the transfer and the security measures should be assessed.

How Should the Data of Former Employees Be Protected?

An employee leaving the job does not mean that their personal data is automatically and completely deleted. Employers may need to keep some data for certain periods under their legal retention obligations.

However, data whose retention period has expired, or which no longer needs to be processed, must be deleted, destroyed or anonymised.

Informing Employees Under the KVKK

Employers have a duty to inform their employees about the processing of their personal data.

Employees should be given clear and understandable information about which data is collected, for what purposes it is used, with whom it may be shared and what rights they have.

The KVKK Compliance Process for Employee Data

To achieve KVKK compliance for employee data, companies need to analyse their existing data flows.

Recruitment processes, personnel files, digital human resources systems, camera practices and employee communication processes should be assessed together.

A properly structured employee data management system helps both to protect employees’ rights and to reduce employers’ legal risks.

Legal Certainty in Protecting Employee Data

Protecting employee data is an ongoing compliance process that goes beyond preparing documents. Employers need to take personal data protection principles into account in their day-to-day practices.

Creating transparent and secure data management policies that respect employees’ private lives forms the basis of a sustainable and lawful working environment for businesses.

Employee Data Protection