A confidentiality undertaking for hotel staff: what to put in it and what the law already says

In Türkiye, Article 12 of Law No. 6698, the KVKK law, already forbids anyone handling personal data from disclosing it or using it beyond its purpose, and that duty continues after they leave. A staff confidentiality undertaking does not create that duty. It names the data, the permitted use, the access limit and the exit step, and records that the person was told.

A guest's ID card is photographed at check-in, a room number is written on a slip, and a payment receipt sits on the desk until the shift changes. The person handling each of these signs a confidentiality undertaking on their first morning, usually a paragraph copied from another hotel, and that paragraph is not what protects the guest. This article reads what the law already requires, then turns it into something you can use: which roles need the clause, what the clause should say, how access limits and exit steps do the real work, and how to teach and check it.

What does Article 12 already require of a hotel?#

Article 12 of Law No. 6698, the KVKK law (Türkiye's personal data protection law), puts two duties in one place: the hotel must take the technical and administrative measures that give an appropriate level of security, and anyone who handles the data must not disclose it or use it beyond its purpose (Cumhurbaşkanlığı Mevzuat Bilgi Sistemi, Kişisel Verilerin Korunması Kanunu No. 6698, 11 November 2026).

The security duty sits on the data controller, which is the hotel, not on the employee. The measures must guard against unlawful processing, unlawful access and loss of personal data. The non-disclosure duty covers two separate acts: disclosing data contrary to the law, and using it beyond the purpose of processing. A person can breach the second without telling anyone anything, for example by looking up a guest's phone number for a private reason.

The same article says the duty continues after the person leaves their duty, so the period after employment is not a gap the undertaking has to invent. A signed page on its own proves little: the hotel should be able to show it checked. What the undertaking adds is specificity. It names the data, the role, the permitted use, the person to report to and the exit step, so a general duty becomes something a staff member can follow and a manager can sample.

What the undertaking cannot do matters as much. It cannot move the hotel's responsibility onto the employee, and it cannot substitute for access control, logging or training. Read the article with your legal adviser before you rewrite your text; this section is a reading of it, not legal advice.

Which roles need a confidentiality undertaking?#

Every role that can see guest identity, contact, payment or stay information.

Front desk and reservations see the widest set: ID details, phone number, room number, rate and payment method, often within a single screen. Housekeeping sees room status, and the fact that a room is occupied is itself personal data; staff also see what a guest left on the desk. Night audit and accounting handle invoices, card slips and the day's payment records. Restaurant, bar and spa staff attach a guest's name to a charge, and often see a room number with it.

Sales and groups hold group lists and corporate contacts; IT and maintenance hold system access, including the person who comes to fix the printer. Seasonal staff, part-timers and interns need the same undertaking as permanent staff, dated to their own engagement. Outsourced cleaners, software integrators and door-lock technicians are not employees of the hotel: the firm needs a data processor agreement, and its staff need their own confidentiality terms. For staff-side data such as candidate CVs, the same logic applies, as covered in KVKK for hotel staff data: candidate CVs, the employee notice and who sees what.

What should the undertaking actually say?#

Six clauses carry the weight: what data is covered, what may not be done with it, who may see it, how to report a mistake, what happens on the last day, and that the duty does not end there.

Write the scope by category, naming what the role touches: identity, contact, payment, stay, complaint notes. Avoid "all information", which names nothing. Write prohibited acts as situations: no sharing with family, friends, press or other guests; no use for a private purpose; no copy to a personal phone, notebook, email address or messaging app. State the access rule: only what the role needs, through the person's own login, never a shared one.

Add a reporting clause with a named person and a simple route for a lost phone, an email sent to the wrong address, or a record seen by someone who should not have seen it. Add the exit steps: return devices and keys, delete personal copies, confirm in writing before the last day. State the continuing duty in plain words, plus the internal consequence of a breach; do not copy penalty figures from another hotel's text, and have your adviser check the wording. Keep the form practical: Turkish, plain language, one page plus a role annex, signed and dated, a copy to the employee, and a version number so you know which text was signed.

Who may see a guest record, and how is access logged?#

Access should follow the role, not the shift: each person uses their own login, sees only the fields the job needs, and the system records who opened which record and when.

A shared "reception" login makes the access log useless and makes the undertaking impossible to enforce, because no one can say who looked. Mask ID numbers and card details on screens where staff do not need them, and keep the guest list off the printer at the desk. Review the access log on a schedule and after any complaint, not only when something goes wrong. Apply the phone-call test: when a caller asks whether a named person is staying, the answer comes from a written policy, not from the judgement of whoever picked up, as discussed in "Is my husband staying with you?" Who may be told about a guest. Camera footage and door-lock records are personal data too, and the same access rule applies to them. An undertaking signed by someone who can see everything protects nothing; the access limit is the part that does the work.

Does the duty continue after the employee leaves?#

Yes. Article 12 says the non-disclosure duty continues after the person leaves their duty, so the undertaking should say the same and the hotel should act on it on the last day (Cumhurbaşkanlığı Mevzuat Bilgi Sistemi, Kişisel Verilerin Korunması Kanunu No. 6698, 11 November 2026).

Revoke system logins and email on the last working day, not when someone remembers. Collect keys, key cards, devices and name badges, and confirm in writing that personal copies have been deleted. Ask for a short exit signature that refers back to the original undertaking and repeats the continuing duty in one paragraph. Keep the signed undertaking on file for as long as you may need to show it; confirm the period with your adviser rather than copying a number from another hotel, and see How long should a hotel keep guest records? Building a retention and destruction table for the record side.

The common failures are dull ones: an account closed three weeks late, a former employee still in the staff messaging group, a laptop returned with the guest export folder on it. If a former employee posts a guest photo, the route is contain, document and call your adviser; do not negotiate in public.

How do you teach it at onboarding and check it is followed?#

Teach it with the situations staff actually meet, then check with samples rather than with another signature.

Ten minutes at onboarding with four scenarios and a short quiz beats a page read in silence; repeat once a year and after any incident. The manager's audit is a sample: five guest records a month, who opened them, whether shared logins still exist, whether leavers' accounts are closed. Record the training and the audit; the record is what shows the measure was taken. When someone breaches, contain first, document second, and tell your adviser third; do not improvise a response at the desk. Keep the scenarios current: the situations change as soon as the hotel adds a messaging channel or a new system. If your hotel is weighing AI assistants, the questions to ask your adviser are close cousins, as covered in AI assistants and guest data: KVKK questions for your adviser.

What to do next#

Take the paragraph you use today, put it next to the six clauses and the role table, and fix the access and exit steps it cannot cover on its own. Then have a lawyer read the final text once. The undertaking then does the job it can do: it turns a duty the law already sets into something a person can follow and a manager can check.