ID photocopies at hotel check-in: what the KVKK principle decision changes

A KVKK principle decision published on 9 December 2025 (No. 2025/2120) holds that a hotel may record a guest's name, surname and T.C. identity number under Law 1774, and may ask to see the identity card to check them, but may not photocopy the card and keep the copy. Front desks verify, notify, and hand the document back.

A guest slides an identity card across the desk and says "take a copy, it is easier for you". Until December 2025 that sentence usually ended with a photocopy in a drawer. The Board has now said what that drawer actually is. This article reads the published decision, separates what it changes from what it leaves in place, and gives you the desk routine, the audit checklist and the staff scripts to run it. The hotel ID photocopy KVKK question is now narrow and answerable, and the answer fits on one page at the desk.

What did the KVKK Board actually decide about ID photocopies at hotels?#

It decided three things in order: recording a guest's name, surname and T.C. identity number under Law No. 1774 is lawful, asking to see the T.C. identity card to verify those details is lawful, and photocopying the card and keeping the copy is excessive processing with no legal basis. The Resmî Gazete text of the decision (9 December 2025) (opens in a new tab) is the source for all three findings.

Name the document precisely when you brief staff: Principle Decision 2025/2120 (ilke kararı), adopted 6 November 2025, published in the Resmî Gazete on 9 December 2025, issue No. 33102. A principle decision states how the Board reads existing law for a sector; it does not create a new statute.

The order of the three findings is the argument. The lawful purpose is verification and notification, and a stored copy adds nothing to either, so it fails the proportionality test in KVKK Article 4 (opens in a new tab): data must be relevant, limited and proportionate to the purpose, and kept only as long as the purpose or the legislation requires.

Why the copy fails even when the purpose is lawful#

The processing ground is not consent. Under KVKK Article 5, data may be processed without explicit consent where a legal obligation applies, and the identity notification is exactly that. A guest's signature on a consent form therefore does not make a photocopy lawful. Consent is not a spare key for processing the Board has already called excessive.

The decision also addresses the past: copies taken before it are to be destroyed in line with KVKK Article 7, and the method is for counsel to confirm. That turns the change from a policy sentence into a project with an inventory and a record.

Read the scope exactly as published. The text concerns the T.C. kimlik belgesi. It is not a general licence to reason about passports, residence permits, group lists or agency files, and this article does not extend it.

What a principle decision is, and what it is not#

A principle decision is the Board's published reading of the law for a whole sector, not a ruling in one hotel's case. It tells you how the Board will treat the question when it arrives, which is why it deserves more weight than an opinion piece and less than an amendment to the statute. Before you rewrite a procedure, open the Resmî Gazete text with your KVKK contact or counsel. A summary, including this one, is a starting point, not legal advice.

Does the decision let the front desk skip the identity check?#

No. Law No. 1774 (opens in a new tab) still says that a facility obliged to give identity notifications may not accommodate anyone who cannot prove their identity with an identity card or another valid official document, and the notification duty is untouched.

Separate the two duties that were always separate: verifying identity at arrival, and notifying the authorities. The decision changed neither; it removed a third habit, the archive, that had attached itself to them.

Law No. 1774 also restricts use of the notifications: without a court order, no one other than the authorised official bodies may make use of them. That is a second reason the front desk should hold this data narrowly.

Verification and notification are two duties, not one#

The check-in flow stays as it is: document in hand, details read and typed, notification prepared and sent, document returned to the guest. Verification is a duty; retention beyond what the purpose and the legislation require is a choice, and the decision says the choice was the wrong one. Train the difference in one line staff can repeat: we must see it, we must not keep it.

If a guest cannot produce a valid official document, the answer is still no accommodation, and that conversation is a separate procedure from this one. For the notification itself, see KBS explained: guest identity notification for hotels in Türkiye and KBS at check-in: a front desk checklist for guest identity.

What changes at the desk: copiers, scanners, phone photos and email attachments?#

Everything that leaves a stored copy of the document behind stops: the copier, the scanner, the phone camera and the attachment sent to a shared inbox are all ways of keeping the copy the decision calls excessive.

Use one test at the desk: does an image of this document still exist after the guest walks away? If yes, it needs a legal basis, and the decision says this one does not exist. The machine is irrelevant; the surviving copy is the problem.

Retire the specific habits: the photocopy stapled to the registration form, the phone photo sent to a manager or a staff group, the scan attached to the reservation, the shared ID folder on the front-office computer, the copy emailed to an accountant or an agency. Format does not change the analysis. A photograph or a scan is still a copy of the document; if a workflow depends on one, take it to counsel rather than to the copier.

The one test: does an image survive the check-in?#

Review the registration form itself. Keep the fields the facility actually needs, such as name, surname and T.C. identity number, and remove any field that exists only to hold an image of the document. Where a copy used to be taken so the form could be filled in later, the replacement is typing at the desk while the guest is present.

Tell the guest what happens instead. A guest who offers a copy is trying to be helpful, and a short explanation costs ten seconds.

Devices that copy quietly#

Check the devices, not just the people: copier and scanner jobs that email to a folder, front-office phones with automatic photo backup, and any tablet left logged in at the desk. These are the places a copy survives without anyone deciding to keep it.

What happens to the copies already in files and inboxes?#

The decision requires copies taken before it to be destroyed in line with KVKK Article 7, so the work is an inventory of where copies live, a destruction, and a written record that both happened.

The decision points businesses to the KVKK Article 7 framework rather than prescribing a method, so the method is yours to choose, to write down and to confirm with counsel.

Where copies hide#

Inventory before destroying. Likely places: paper guest files, night-audit packs, group and agency folders, front-office computers, scanner email folders, shared mailboxes, staff phones, and correspondence with agencies. Staff phones are the hardest location to inventory and the easiest to forget. Ask, collect, delete, and write down that you did.

Stop the inflow first. A destruction drive that runs while the copier still produces copies simply refills the drawer.

What a destruction record needs to show#

Record what you did: date, location, method, who carried it out, and roughly how many documents. A single page per location is enough; this is evidence of a decision, not a project.

Do not destroy records your accountant or counsel tells you to keep. The question is whether an image of the identity document is required for those records, and that is a question for them. Then close the loop: update the KVKK notice and the staff handbook so they describe the desk as it now works, not as it worked before December 2025. For the wider frame, see KVKK for hotels: notices, consent, staff access and retention.

What do you say to a guest who offers a copy of their ID?#

Thank the guest, explain that the hotel only needs to see the document, and hand it back. The sentence should be short, identical every time, and ready in Turkish and English.

Scripts exist because staff improvise under pressure, and improvisation is how the old habit comes back on a busy night. The wording must not suggest the guest did anything wrong, and must not promise anything about other data the hotel holds.

Turkish and English, side by side#

The escalation script#

Prepare a third script for the awkward case: an agency that sends ID images with a rooming list, or a guest who insists. The desk does not argue and does not accept; it passes the matter to the hotel's KVKK contact. Keep the scripts in the front-office handbook and at the desk, in both languages, and read them in the daily briefing until they are automatic. Review the scripts with counsel once, then leave them alone. Rewriting them monthly is how wording drifts into promises.

Which questions should go to your lawyer rather than the front desk?#

Anything the published text does not answer: passports and foreign guests, group and agency rooming lists, retention periods, and how to destroy what is already stored.

Passports: the decision speaks of the T.C. kimlik belgesi. Do not assume it says nothing about passports, and do not assume it says everything; ask counsel, and apply the Article 4 minimisation test in the meantime. Groups and agencies: a rooming list carrying identity numbers is data, and an attached ID image is a copy. Ask who is controller and who is processor for that file, and where it may be stored.

Retention: how long the facility keeps guest identity data, and whether the notification record and the hotel's own record run on different clocks. Destruction method and evidence: what counts as destruction for paper, for a phone and for a mailbox, and what record counsel would want to see.

Staff devices and leavers: what the policy says about a personal phone that has held a guest document, and what happens on the last day of employment. The paperwork you already publish: whether the registration form and the KVKK notice still describe what the desk actually does after the procedure changes. The decision text itself: read it with counsel before the procedure changes, and keep the reading on file with the date. For guest requests that follow from these records, see Guest data requests under KVKK: a front office procedure.

The four questions to put in writing this month#

Put these four to counsel in writing, and keep the answers on file: one, the passport and foreign-document question; two, the group and agency rooming list question; three, the retention periods for identity data and notification records; four, the destruction method and the evidence it must leave behind.

What to do next#

The next step is a two-week sequence, not a policy document. This week, stop the inflow: brief the desk, switch off the copying habits, and post the scripts. Next week, inventory where copies already live and take the scope questions, passports, groups, retention and destruction, to counsel in writing. The decision is narrow and easy to obey once the two duties are separated: the hotel must see a valid document and must notify, and it must not keep the image.