KVKK for hotels: notices, consent, staff access and retention

KVKK is Türkiye's personal data protection law (Kişisel Verilerin Korunması Kanunu). For a hotel it means four duties: tell guests what you do with their data, have a lawful basis for each purpose, limit who inside the hotel can see it, and delete it when the purpose ends. Legal bases and periods belong with your adviser.

A guest hands over an ID at check-in, charges dinner to the room, messages the front desk on WhatsApp, and asks for the same sea-view room next year. By checkout the hotel holds five separate records about one person, created by four departments, and nobody has decided which of them may be kept, by whom, or for how long. This article turns KVKK into front office practice: what the law actually asks, which records a stay creates, who inside the hotel needs which slice, and how to prove, store and delete it.

What does KVKK actually ask a hotel to do?#

KVKK sets how personal data may be collected, used, kept and deleted, and a hotel that decides why and how guest data is processed is the data controller (veri sorumlusu) for it. The law reduces to four duties, and each one lands on a different person in the building.

The controller is the party that sets the purposes and means of processing, as defined in Law No. 6698, consolidated text, Articles 3 and 10 (opens in a new tab) (mevzuat.gov.tr, 2026). A hotel is normally the controller for its own reservations, folios and guest messages. That label matters: it is the hotel, not its software provider, that answers for the data.

Duty one, inform. When collecting data, the controller must tell people its identity, the purpose, to whom and why data may be transferred, the method and legal basis of collection, and their rights (same source, Article 10). Duty two, have a basis: data may not be processed without explicit consent unless a listed condition applies, among them processing expressly provided for by law, processing necessary to set up or perform a contract with the person, or processing necessary to meet a legal obligation (same source, Articles 4 and 5). Duty three, protect: the controller must take the necessary technical and administrative measures against unlawful processing and access, is jointly responsible for those measures with anyone processing on its behalf, and must notify the person and the Board as soon as possible if data is obtained by others unlawfully (same source, Article 12). Duty four, stop keeping it: data may be kept no longer than the relevant legislation or the purpose requires, and when the reasons end the controller deletes, destroys or anonymizes it on its own initiative or on request (same source, Articles 5 and 7).

The common misreading is to treat KVKK as a consent form. Consent is one basis among several, and the notice is owed even when no consent is needed. Hotel compliance in Türkiye: the four steps of every stay covers how these duties sit next to payment, fiscal documents and the identity notification.

Why does one stay create so much personal data?#

Because a stay is not one transaction but a chain of them, and each link is created by a different department for a different purpose. The data map is the first document to build, before any text is written.

A normal stay leaves behind the reservation, the identity record behind the KBS notification (misafir kimlik bildirimi), the folio (misafir hesabı) with its charges, the messages exchanged before and during the stay, the preference notes, and the marketing permissions. For each record write four things: where it is created, why it exists, who inside and outside the hotel sees it, and which legal basis and period your adviser assigns to it. The last column is not yours to fill in.

Notice the different clocks. The folio is tied to tax and accounting rules, the identity record to the KBS duty, the preference note to a service purpose that ends at checkout. One blanket period for everything is the usual mistake. Also handle data you did not collect from the guest: when an agency or booking site sends a reservation, the person must still be informed within a reasonable time, at the start of communication, or at the latest when the data is transferred, under Articles 5 and 6 of the inform duty communiqué (opens in a new tab) (Resmî Gazete, 10 March 2018). Treat allergy and accessibility notes as possibly sensitive data and route them to counsel rather than deciding a rule at the desk.

Keep the map to one page per department. A map nobody can read at the desk will not survive a busy Saturday.

The five records a stay leaves behind#

Who inside the hotel needs which data?#

Each role needs the smallest slice that lets it do its job, and the notice must reflect that: the communiqué requires the notice to be given separately by each department that processes data for a different purpose (Resmî Gazete, inform duty communiqué, Articles 5 and 6, 10 March 2018).

Front desk needs the reservation, the identity record and the folio. Housekeeping needs the room, the stay dates and the request, not the passport number. F&B needs the room number and the folio. Accounting needs the fiscal record. Management needs aggregates, not individual histories. Marketing is a separate department with a separate purpose, so it needs its own notice and its own approval record; a single generic text shown at booking does not cover the spa, the restaurant or the newsletter.

Shared logins destroy the record. A named account per person is what makes it possible to say who looked at what. Access must be removable on the day someone leaves, including seasonal staff and agencies working on site. The controller is jointly responsible for security measures with anyone processing on its behalf (mevzuat.gov.tr, Law No. 6698, consolidated text, Article 12, 2026), and that includes the software provider holding the data. If you use multi-hotel software, how each hotel's data stays apart is part of the same question.

Test the matrix rather than trusting it: ask a housekeeping account to open a passport scan and see what happens.

Is a privacy notice the same as consent?#

No. The notice is information you owe in every case; consent is one possible legal basis, and it must be obtained separately from the notice. Marketing permission is a third act under a different law.

The notice does not depend on the guest asking for it, must be provable by the hotel, and where processing relies on explicit consent it must be given separately from obtaining that consent (Resmî Gazete, inform duty communiqué, Articles 5 and 6, 10 March 2018). Explicit consent means consent on a specific matter, based on information and given freely (mevzuat.gov.tr, Law No. 6698, consolidated text, Article 3, 2026). A sentence that covers everything is not specific.

Consent is not always the right basis. Where processing is expressly provided for by law, necessary for the contract with the guest, or necessary for a legal obligation, the law allows it without consent (same source, Article 5). The notice is still owed. Marketing messages sit under the electronic commerce law: they may be sent after the recipient's prior approval, given in writing or by any electronic means, the content must match the approval, and the recipient may refuse at any time without giving a reason; messages to tradespeople and merchants do not need prior approval (mevzuat.gov.tr, Law No. 6563, consolidated text, Articles 6 to 8 (opens in a new tab), 2026).

The common failure is one checkbox at check-in that bundles the notice, consent for everything and the newsletter. Split it into three records and the rest becomes easy. Make withdrawal as simple as giving: a guest who says stop should be able to stop it at the desk, in a reply, or in the guest app.

How do you prove what a guest agreed to?#

By storing the text itself, not a tick. A record that says "consent received" without the wording, the version and the moment proves nothing to a guest, an auditor or a court.

Store the full text of the notice and of the consent as they were shown, with a version identifier. When the wording changes, the version changes, and old records stay tied to the old text. Capture the moment, the channel and the language: paper form at the desk, checkbox in the property system, web form at booking, guest app before arrival. Each channel needs the same fields.

For marketing, record which channels and which kinds of content were approved, because the message must match the approval given (mevzuat.gov.tr, Law No. 6563, consolidated text, Article 6, 2026). Scan paper forms into the guest's record the same day; a folder of forms in a drawer is not a record, and it is also a security problem. Record withdrawal with the same care as consent, including the date and the channel it came through. Make the record survive staff turnover: it must live in the system, not in one receptionist's memory of what was said.

How long may a hotel keep guest data, and how should it be deleted?#

The period comes from the legislation that applies to each record and from the purpose it was collected for, and it is set with your counsel and accountant. The hotel's job is to enforce that period in the system, not to choose it.

The law requires data to be kept no longer than the relevant legislation or the purpose needs, and deletion, destruction or anonymization once the reasons for processing end (mevzuat.gov.tr, Law No. 6698, consolidated text, Articles 5 and 7, 2026). The deletion regulation (opens in a new tab) (Resmî Gazete, 28 October 2017) requires controllers that must register with the Data Controllers' Registry to prepare a retention and destruction policy, sets periodic destruction at intervals fixed in that policy that may not exceed six months, gives controllers without such a policy three months, and, when a person asks for deletion and all processing conditions have ended, requires the controller to delete, destroy or anonymize, inform the person within thirty days at the latest, and notify any third party it transferred the data to. Whether your facility must register is a question for counsel; do not let the front office guess at thresholds.

Separate the three verbs: deleting removes the record, destroying makes it unrecoverable, anonymizing keeps a statistic with no person in it. Choose per record type, in writing. Deletion must reach the backups and the exports, or the period is only a promise on a screen. Configure the period once, in the system, with a review date; a process that depends on someone remembering is not a retention policy. When a guest asks for deletion, a front office procedure for guest data requests keeps the answer inside the thirty-day limit.

What about agencies, booking sites and software providers?#

They are separate parties in the chain, and the hotel stays responsible for the measures taken on its behalf. Each one belongs in the notice and in a written agreement.

The notice must state to whom and why data may be transferred (mevzuat.gov.tr, Law No. 6698, consolidated text, Article 10, 2026). If the list of recipients has changed since the text was written, the text is out of date. The controller is jointly responsible for security measures with anyone processing data on its behalf (same source, Article 12), so a software provider without a written purpose, period and deletion clause leaves that responsibility one-sided.

Ask every provider three questions: what do you do with our data beyond running the service, how long do you keep it after we leave, and can you return and delete it on a date we set. Data arriving from an agency or booking site still triggers the notice, within a reasonable time, at the start of communication, or at the latest when the data is transferred (Resmî Gazete, inform duty communiqué, Article 6, 10 March 2018). Cross-border questions, including where a provider stores or processes data, go to counsel with the contract in hand. AI tools that read guest data raise the same questions plus a few of their own; KVKK questions to put to your adviser about AI assistants and guest data covers them.

What to do next#

The next step is a one-page data map per department, with the four duties written across the top and the legal basis and period columns left blank for your adviser to fill. Everything else in this article follows from that page: the notice text, the split between notice, consent and marketing permission, the access matrix, and the deletion settings in the system. KVKK is not a form you sign once; it is four duties that have to be visible in the software and in the rota.

On the software side, the AI Otel hotel operating system is built with KVKK consent, data export and retention periods in the data model itself: it is built and working, ahead of launch, and the periods it enforces are the ones your adviser sets. If that approach fits your plans, talk to OtelCiro.