CCTV in hotels under KVKK: a checklist for notices, placement and footage

Under KVKK, a hotel camera system is personal data processing: cameras go only where a security purpose justifies them, never in toilets, changing rooms, prayer rooms or rest areas, never with audio or face recognition by default; a sign marks each recorded area, a full notice explains the purpose, and footage is access-controlled and deleted on a schedule counsel sets.

A guest asks to see the corridor recording from last night. The front office manager wants to help, the security lead wants to check the rules, and nobody is sure who may press export. That moment was settled months earlier, by where the cameras were placed and what was written at the door. This article turns hotel CCTV KVKK compliance into a zone-by-zone checklist: placement, notices, sound and face recognition, viewing and export rights, retention, and a camera register with one owner per line.

What do KVKK's June 2026 camera announcements actually say?#

On 8 June 2026 the Personal Data Protection Authority published a public announcement on security cameras in workplaces, and it does not name hotels. The announcement, published by the Kişisel Verileri Koruma Kurumu (2026) (opens in a new tab), says recording people on camera is personal data processing and needs a legal basis under Law No. 6698. It asks for data minimisation and a purpose fixed at the outset: workplace security, preventing and detecting crime, or occupational health and safety.

It names the places where a camera may be proportionate, entrances, exits and storerooms, and risk points such as the cash desk, judged by position and field of view. It names the places where a camera should not be: toilets, changing rooms, prayer rooms (mescit) and rest areas. It also says cameras should not be used to track employees' attendance or performance, and that failing these points can lead to administrative fines under Article 18. Amounts belong with your adviser, not with this article.

A hotel is a workplace, so the announcement bears on it directly, and a hotel applies its reasoning to guest areas as well. It is not a hotel-specific rule: read this article as a way of applying it, and let counsel confirm your own case.

Where may cameras go in a hotel, and where may they not?#

A camera belongs where a stated security purpose justifies it and where a person can reasonably expect to be recorded; it does not belong anywhere a person expects privacy. Start from the risk, not from the camera: write down what each camera answers (theft at the till, unauthorised entry at the back gate, a blind corner in the car park) before anyone chooses a position.

Frame the risk point, not the whole room. A camera on the cash desk is proportionate; a wide-angle view of the entire lobby is not, and the announcement warns against recording that covers the whole workplace. Corridor cameras need a specific documented reason: a camera looking down a guest floor records who enters which room, which is more data than security usually needs.

Pool, beach and spa decks are where guests wear swimwear and expect not to be watched; keep cameras at the entrance and off the deck. Children carry extra weight in the balance: the announcement asks controllers to weigh the effect on people who are not under supervision, especially people who need special protection. Staff areas follow the same logic: a storeroom or a staff entrance may justify a camera, a rest area or a locker room does not.

What must the camera notice say, and where does it go?#

Two documents, not one: a short sign at the entrance to each recorded area, readable before the person is recorded, and a full privacy notice (aydınlatma metni) that explains the processing and can be obtained on request. The duty to inform applies in every case where personal data is processed, whether the hotel relies on explicit consent or on another condition in the law, under the Authority's communiqué on the duty to inform (Aydınlatma Tebliği, Official Gazette 10 March 2018 (opens in a new tab)).

The burden of proving the notice was given lies with the hotel, so keep the text, its version, the date it went up and a photograph of where it hangs. A new purpose needs a new notice, given before processing starts: adding a camera to watch a stockroom is a new purpose even if the sign at the door is unchanged. The stated purpose must be specific, explicit and legitimate; wording that suggests the data may be used for other purposes that may arise fails the test.

Notice and consent are separate acts: a camera sign is not consent, and consent does not replace a legal basis you do not have. Staff get their own notice, delivered in a way you can prove, not only a sign in the corridor. For the wider framework of guest data notices and consent, see KVKK for hotels: notices, consent, staff access and retention.

Can a hotel record sound or use face recognition?#

No by default. The announcement says cameras that record audio should not be used unless their lawful reason and necessity are clearly shown, and that face-focused recording should not be made. Check on your own recorder whether audio recording is enabled: check the setting, not the box the camera came in.

Face recognition on guests or staff goes beyond what the announcement allows; face-focused recording is named as something not to do. Wide-angle recording that covers the whole workplace is named too: a camera that happens to catch everything is not a neutral choice. Cameras used to track attendance, breaks or performance sit outside the purposes the announcement recognises.

If someone proposes audio or analytics, ask for the written lawful reason and the necessity test first; without both, the answer is no.

Who may view and export footage, and how is each request logged?#

Only people named in an authorisation matrix, for a stated reason, with the export written down: viewing is a processing activity like any other. The announcement itself asks for access limited to authorised persons, using technical and administrative measures such as an authorisation matrix. Build the matrix by role: live view, replay, export, delete. Front office usually needs none of the four; security needs view and replay; one named person holds export.

Log every export: date and time, who asked, why, the clip's time range and camera, who approved it, and where the file went. Guest requests start with an identity check and a check whether the clip also shows other guests whose data would be disclosed; the answer goes out in writing. Police requests: note the officer's name, unit and case reference, ask for the request in writing, and record exactly what was handed over. Insurers, lawyers and managers are third parties like any other: a transfer needs a legal basis, and curiosity is not one. Deleting a clip outside the schedule is itself a processing event: it needs a reason and a log line. For the wider procedure, see Guest data requests under KVKK: a front office procedure.

How long may a hotel keep camera footage?#

No fixed number of days is written into the law for camera footage; the period comes from the purpose, is set with counsel, and is enforced by automatic deletion rather than by good intentions. The announcement asks for the shortest possible retention with an automatic deletion mechanism, so the recorder overwrites on a schedule instead of waiting for someone to remember.

Controllers that must register with the Data Controllers' Registry prepare a personal data retention and destruction policy, and the periodic destruction interval fixed in that policy may not exceed six months (Regulation on the Deletion, Destruction or Anonymization of Personal Data, Official Gazette 28 October 2017 (opens in a new tab)). Controllers without such a policy apply a three-month interval under the same regulation. Whether your hotel must register is its own question: see VERBİS for hotels: when a hotel has to register.

After an incident, keep only the relevant recording for the legal proceedings; the rest of the archive still deletes on schedule. When a person asks for deletion and every processing condition has ended, the hotel deletes, destroys or anonymizes the data, answers within thirty days at the latest, and notifies any third party it transferred the data to. Write the deletion down: date, camera, period covered, who ran it. A deletion you cannot show is a deletion you cannot defend.

What belongs in a camera register?#

One line per camera, with a named owner, so that the answer to "why is this camera here" exists before anyone asks. The register shows a purpose for every camera, and shows the gap where a camera has none. One owner per line means a person's name, not a department: a department cannot be asked a question.

Review it when a camera moves, when a purpose changes, and on a fixed date each year. Keep it beside the notice texts and the export log: together they are the evidence file for a KVKK question or an inspection. The register also records what you decided not to record, which is often the more defensible decision. The same role-and-permission thinking applies to your other systems: see PMS user roles and permissions: a setup checklist for hotels.

A fuller register adds columns for the legal basis confirmed by counsel with its date, the notice sign reference, the retention period, who may view or export, and the last review date.

What to do next#

Start with the register: list every camera, its field of view and the risk it answers, then strike out the ones that answer nothing. That single page tells you which signs to print, which settings to switch off, and which retention period to agree with counsel, and it turns the rest of this checklist from principles into tasks with names against them.