Staff time tracking in hotels after KVKK’s biometric decision: choosing a system

A hotel staff time and attendance system (PDKS, personel devam kontrol sistemi) records when each employee starts and ends work. After the Personal Data Protection Board's Principle Decision 2026/921 of 29 April 2026, hotels should record attendance with cards, PINs, signed sheets or supervised manual entry rather than fingerprint or face data, and confirm their own case with counsel.

Where a fingerprint reader still stands beside the staff door, it has been sitting on a legal question since 2 June 2026, and payroll may still be running on it. This guide explains what the official texts actually say, what can replace the reader at the staff door, how the record survives several gates, split shifts and a season, how it becomes a signed timesheet for payroll, and what to do with the fingerprint templates you already hold.

What does KVKK's decision 2026/921 actually say?#

It says that using fingerprint, face, iris or retina scanning to track employees' working time is not lawful, and it names the methods a hotel should use instead. The Personal Data Protection Board's Principle Decision 2026/921 of 29 April 2026 (opens in a new tab), published in the Resmî Gazete of 2 June 2026, covers biometric identification systems used for attendance tracking. It is a principle decision (ilke kararı): it states the Board's reading of the law for all controllers, not a ruling on one hotel.

The chain of reasoning, step by step#

The decision works through the law in a fixed order, and each step closes a door hotels often rely on.

First, the law requires working time to be recorded, but says nothing about how. So the condition "expressly provided for by law" cannot be used, and none of the other processing conditions in Article 6(3)(b) to (g) of Law No. 6698 applies either. Second, explicit consent under Article 6(3)(a) is the basis hotels usually choose, but the Board doubts it rests on free will given the power imbalance between employer and employee. Consent is therefore not on its own a sufficient legal basis.

Third, even where valid explicit consent exists, biometric attendance tracking fails the proportionality principle in Article 4, because less intrusive alternatives are available. The decision lists them: encrypted cards, PIN-based systems, traditional signatures and paper attendance sheets, RFID/NFC ID cards, and manual entry under a supervisor's oversight. Controllers found not to comply face action under Article 18 of the Law. This article prints no amounts, because the figures are re-valued and amended; ask your accountant or legal adviser.

What the 27 August 2026 notice adds#

The Authority's public notice of 27 August 2026 (opens in a new tab) answers the opinion requests controllers sent after the decision. It confirms that biometric data are among the special categories in Article 6 of Law No. 6698, and that the list cannot be widened by analogy. A fingerprint converted into a mathematical code and stored in a database is still biometric data.

The notice repeats that employers must track and document working time, but that no explicit legal provision provides for doing so with biometric identification systems, so attendance tracking by biometrics may be unlawful. It then treats some facilities and areas separately because of their security risk. There, biometric systems may form part of identity verification, authorisation and access control for critical areas, but only if the processing is limited to the necessary areas and persons, alternatives are insufficient, and the processing is proportionate to the concrete security need.

Banned, or exceptional?#

The decision governs attendance tracking; the notice governs access control in critical areas and leaves other purposes to a case-by-case assessment. The notice is not a general permission to keep the reader at the staff door.

What do you actually have at the staff door today?#

Before choosing a replacement, list every device, every stored template and every person who can reach them. An inventory you can complete in one walk is the foundation for everything that follows.

Walk the whole building, not just the staff entrance: back-of-house corridors, kitchen, laundry, pool and beach huts, annex buildings, and any outlet in a separate block. For each device, note the make and model, the vendor, who holds the administrator password, and whether templates live in the device, on a local computer or on the vendor's server.

Separate the two jobs a device may do: opening doors (access control) and clocking attendance. The legal question is different for each, and one device often does both. Then find the copies: exported spreadsheets, an old laptop in the IT room, backups, and any file the vendor holds under the service contract. Read that contract: is there a data processing agreement, a deletion obligation at termination, and a list of sub-processors?

Count the people enrolled, and check whether former employees' templates are still on the device. Finally, write down today's fallback for when the reader fails: a paper sheet, a supervisor's note, or nothing at all. That fallback is the system you will actually run.

What replaces the fingerprint reader?#

The decision names five methods: encrypted cards, PIN entry, RFID/NFC ID cards, signed paper sheets and manual entry under a supervisor. Each trades one risk for another.

Cards and RFID/NFC ID cards are fast and work with wet or gloved hands in a kitchen. The risk is a card handed to a colleague; the control is one card per person, a photograph on the card, spot checks, and a written rule that lending a card is a disciplinary matter. PIN entry needs no card to lose, but a PIN is shared more easily than a card: rotate PINs and require a supervisor to reset one.

A signed paper sheet is the cheapest option and processes little data beyond the sheet itself. Its weakness is retrospective filling; the control is a supervisor's daily signature and a rule that entries are made at the time, not at month end. Supervised manual entry suits small teams and sites with no fixed door, such as gardeners or pool staff; the cost is supervisor time, and the supervisor must not record their own hours.

Whatever you choose, the record must show the actual start and end of work including breaks, and be signed off before it reaches payroll. And a card or PIN system is not automatically compliant: purpose limitation, retention periods, access rights, the vendor contract and informing employees still apply, and the device vendor's assurance is not a legal opinion.

How does the hotel staff time and attendance system work with several gates, split shifts and seasonal staff?#

Attendance is not one door: it is a rule about which door counts for which employee, plus a record that survives a season.

With several gates, decide the attendance point per department. Kitchen staff clock at the service entrance, not the lobby turnstile, and a reader on a door that is only sometimes used creates gaps in the record. Split shifts mean two arrivals and two departures in one day: the record must sum the intervals, not count the first arrival and the last departure, or the total will be wrong in both directions.

Night shifts crossing midnight belong to the shift that started, not to the calendar day. Agree this with your accountant before the first payroll run, not after. Seasonal joiners should be enrolled on day one with a signed information notice, and given a deletion step on the last day: a template or card left active after the season is both a liability and a security hole. For lodging staff, being on site is not the same as working: record the shift, not the time spent in the building, and keep rest periods visible in the record. Supervisors doing manual entry need a second signature and a rule that they cannot record their own time or a relative's. These choices sit inside the wider question of hotel shift planning: covering the desk, floors and nights fairly.

How do attendance records become payroll, overtime and rest records?#

The timesheet (puantaj) is the bridge: the clock record is the evidence, the signed timesheet is what payroll uses.

The record must carry start, end and break. A record with only an arrival and a departure cannot show whether the legal rest break was given. Overtime needs the employee's consent and sits inside the annual overtime cap; the attendance record is how you show both the hours worked and that consent exists. The details of the weekly limit and the balancing period and of consent, the annual overtime cap and time off are covered in separate guides; for the current rules, check those guides and your accountant or counsel.

A balancing period (denkleştirme) means some weeks run long and some short. The system must total across the whole period per employee, not just per day, or the balance cannot be proved. Sign-off should go department head first, then HR or the accountant; one signature is not enough where the signer also works that shift.

Corrections: never overwrite an entry. Add a correction line with a reason and a signature, the same principle as voiding an invoice rather than deleting it. For retention, keep attendance records as long as labour and tax rules require and your own retention table says. Fix the period with your accountant and counsel, and write it down.

What should you do with the fingerprint templates you already hold?#

Stop adding to them first, then decide with counsel whether and when to delete, and record whatever you decide.

Stop collection on a stated date: switch the device to card or PIN mode, or take it out of service, and tell staff in writing what changes and why. Then locate every copy: device memory, the vendor's server, exported files, backups and the old laptop. A deletion that misses the vendor's copy is not a deletion.

Deletion is the natural reading of the decision, but timing, employee information, any pending labour dispute and your contract with the vendor are legal questions, not IT questions. When you do delete, prove it: a written deletion request to the vendor, a written confirmation back, and an entry in your destruction record with the date and the person responsible. Tell employees what changed, update your processing inventory and your retention and destruction policy, and confirm with counsel which written obligations apply to your facility. Do not budget from memory on fines: administrative amounts are re-valued and amended, so ask your accountant or legal adviser for the current position.

What should you ask a system provider?#

Ask what the system records, where it stores it, and what happens on the day you leave.

Ask which methods it supports: card, PIN, RFID/NFC, manual entry with supervisor approval. Ask whether it can run with no biometric option at all, or whether biometrics is the default path. Ask where the data is stored, who can access it, and whether you can get a per-employee period total for the balancing period and the overtime cap.

Ask whether it keeps an audit trail of corrections, showing who changed what and when, and whether a correction can be added without overwriting the original entry. Ask whether seasonal enrolment and end-of-season deletion are defined steps, or a manual chore someone will forget in October. Ask what happens at contract end: export format, deletion, and written confirmation of deletion. And ask whether it feeds your payroll and the hotel's operating system directly, or whether someone will retype the hours every month. Retyping is where overtime disputes are born. How attendance fits into the wider software picture is covered in what hotel software covers, department by department.

What to do next#

Pick a date, take the reader out of attendance mode, and put the inventory in front of your counsel and your accountant in the same meeting. The order matters: understand what the decision and the August notice actually say, list what you hold, choose a method whose risk you can control, make it fit several gates and a season, carry the record through to a signed timesheet, and only then delete the old templates and talk to vendors.