KVKK for hotel staff data: candidate CVs, the employee notice and who sees what

A hotel owes applicants and staff the same duty to inform it owes guests: a notice naming the controller, the purposes, the transfers, the collection method and the legal reason, plus the person's rights, given when data is first collected. CVs of people not hired may be kept only while a stated purpose lasts.

Every spring a seasonal hotel takes in a few hundred CVs, and by June nobody can say which of them were destroyed, where they are stored, or who has opened the folder. The guest side of KVKK gets the attention; the staff side is where the files actually pile up. This article covers the applicant notice, the employee privacy notice KVKK requires, health reports, access rules and exits. After reading, you can audit your own staff-data trail in an afternoon.

What staff data does a hotel actually hold?#

More than the guest side suggests: a hotel processes identity, contact, bank, health and performance data for every applicant and every employee, and each set has its own purpose and its own audience.

Applicants hand over a CV, sometimes a cover letter and references, and often an ID copy or a health certificate before any contract exists. Employees add identity and address, IBAN, the SGK declaration, an emergency contact, the signed contract, leave records, timesheets, performance notes and any disciplinary file. Health data arrives from the pre-employment examination, the periodic examination, the workplace doctor and sick notes; it is special-category data and belongs in its own file.

One legal ceiling covers all of it. Under Article 419 of the Turkish Code of Obligations (Law No. 6098), an employer may use a worker's personal data only as it relates to the worker's suitability for the job or as needed to perform the employment contract, with special statutory provisions reserved, per the consolidated text on the Presidency's legislation system (2026-11-07) (opens in a new tab). That is a ceiling, not the whole rule.

Practical check: for every data set, write the purpose in one sentence. If you cannot, you probably should not be holding it.

What must the notice to job applicants say?#

The same five items every KVKK notice needs, given at the moment you collect the CV rather than at the contract stage.

Article 4 of the Communiqué on the Procedures and Principles for Fulfilling the Duty to Inform (Resmî Gazete, 10 March 2018, No. 30356, amended 28 April 2019, No. 30758) requires at least: the identity of the controller and of its representative if any; the purpose of processing; to whom and for what purpose data may be transferred; the method and legal reason for collecting it; and the person's other rights under Article 11 of Law No. 6698, per the Personal Data Protection Authority's Communiqué (2026-11-04) (opens in a new tab).

Article 5 of the same text adds the working rules. The notice is owed whether processing rests on explicit consent or on another condition in the Law. It does not wait for the person to ask, and the controller must be able to prove it was given. Informing and obtaining consent are separate steps, and the wording must be specific, plain and complete: "we process your data for recruitment" is vague, while "we keep your CV and interview notes for this vacancy, for the period stated below" is a purpose. Name the legal reason you rely on under Article 5 or Article 6, and say whether the data is collected by fully automated, partly automated or non-automated means as part of a data recording system.

When the CV arrives from an agency, a referral or a public profile rather than from the person, Article 6 applies: inform within a reasonable time of obtaining it, at first contact if you will use it to communicate with them, and at the latest when it is first transferred. Give the notice in a form the applicant keeps, for example a link on the application page plus a copy by email, and log the version and the date. The same structure works for the guest side; see KVKK for hotels: notices, consent, staff access and retention.

How long may a hotel keep the CVs of people it did not hire?#

No text sets a fixed period. The limit is the purpose: you may keep a CV only while a purpose you have stated still exists, and you must be able to say when that purpose ends.

Keeping a CV for a future season is a legitimate purpose, but it has to be written down, told to the applicant in the notice, and given an end date. If you have no such purpose, destroy the CV when the vacancy closes and record the destruction. The decision is made when you design the application form, not when the folder is full.

The usual failure is not a decision but an accumulation: a shared inbox, a folder on the front-desk computer, a box in the HR cupboard, a messaging group where CVs were forwarded. A destruction record needs the date, the data set, the method and the person who did it. Without it, "we deleted it" is a claim, not evidence. For the wider record-keeping question, see building a retention and destruction table for hotel records.

What must the employee notice cover, section by section?#

The same five statutory items, written for the employment relationship, with one purpose and one legal reason per data set instead of one paragraph covering everything.

The controller is the operating company that employs the person, with its address and any representative; a brand name is not the controller. Name each purpose separately: payroll, SGK declarations, occupational health and safety, access control, training and performance. Name the transfers too: payroll adviser, accountant, bank, occupational safety company, workplace doctor and software providers, each with the purpose of the transfer, and recipient groups rather than individuals.

State the legal reason per data set: performance of the contract or a legal obligation for payroll and SGK work, and the employment, occupational health and safety ground in Article 6(3) for health data, with the Board's measures in place. Say which channels feed the file, such as forms, the payroll system, the time clock and the workplace doctor. List the Article 11 rights with a named route to use them, not a generic address nobody reads. Finally, remember that a new notice is needed before processing when the purpose changes, for example when a performance file turns into a disciplinary file.

Health data: how should a hotel handle the workplace doctor's reports?#

Health data is special-category data: processing it is prohibited except on the grounds listed in Article 6 of Law No. 6698, and the employment and occupational health and safety ground is the one hotels normally rely on, with the Board's measures taken in every case.

Article 6(1) lists the special categories, health among them. Law No. 7499 (adopted 2 March 2024) repealed Article 6(2) and rewrote Article 6(3), so read the current consolidated text of Law No. 6698 (2026-11-07) (opens in a new tab). The grounds now include explicit consent, an express provision in law, protection of life or bodily integrity, data the person has made public, establishing or protecting a right, public health and care services, employment and occupational health and safety obligations, and non-profit bodies for their members. Article 6(4) adds that the adequate measures set by the Board must be taken in every case.

In practice, keep health reports in a separate file with separate permissions, not inside the general personnel folder, and do not email a report to department heads. Share the decision a manager needs, fit or not fit for a night shift, not the diagnosis behind it. The pre-employment examination, the periodic examination and the sick note are three documents with three audiences. Confirm with your workplace doctor and your adviser which documents you must hold and for how long; for the doctor's own role, see safety expert and workplace doctor requirements for hotels.

Who may open which file, and what do they sign?#

Access follows the purpose of the processing, not seniority, and every person who can see guest or staff data signs an undertaking that says what they may do with it.

A confidentiality undertaking should be short and specific: which systems, which data, what is allowed, what is forbidden, what happens on exit, and that the duty survives the job. It is signed at hiring and re-signed when the role changes. A generic page signed years ago and never revisited protects nobody.

Lookups are the quiet risk. A receptionist searching a well-known guest's reservation is a data breach, not curiosity; say so in the undertaking and in training. Log who accessed what where the system allows it, and review the log when a guest complains. Answering questions about a guest is a separate decision from seeing the file, and it has its own rule; see who may be told about a guest. Review the access list once a season: roles change faster than documents do in a hotel.

What closes when a staff member leaves?#

Access closes on the last working day, in the same way it was opened: one list, one owner, one signed check.

Close the accounts: the hotel system, the back office, the shared inbox, booking channel logins and any supplier account the person used. Remove the shared channels: the managers' messaging group, the drive folder, the cloud folder the person created. Collect the physical items: keys, key cards, the personnel file, and the paper CV pile the person kept. Check forwarding: an email rule copying mail to a personal address is a leak that survives the exit.

The undertaking signed at hiring is what makes the exit enforceable; remind the leaver of it in writing. The leaver's own personnel data stays under the retention rules that apply to payroll and employment records; confirm the periods with your accountant or adviser and destroy the rest. Keep the signed exit checklist in the file: it is the evidence that access was closed.

What to do next#

Start with the smallest set you can finish: the CV pile from the last hiring round. Write its purpose and its end date in one sentence, tell applicants that sentence in the notice, destroy what falls outside it, and record the destruction. The employee notice, the health file, the access list and the exit checklist all follow the same pattern: name the purpose, name the audience, name the end.