Turkish DPA Clarifies That Biometric Data Cannot Be Used for Attendance Tracking
On 27 August 2026, Turkish Personal Data Protection Authority (“DPA”) published a public announcement clarifying its Personal Data Protection Board’s (“Board”) Principal Decision No. 2026/921 of 29 April 2026 on the processing of biometric data for employee attendance tracking.
The DPA reiterated that processing biometric data solely for attendance-tracking purposes does not rely on any of the processing conditions, even where valid explicit consent exists, such processing fails the proportionality requirement under the general principles. It also clarified that converting fingerprints, palm scans or similar data into mathematical codes does not prevent them from qualifying as biometric data. Drawing on both Turkish legislation and EU General Data Protection Regulation, the DPA also confirmed that converting fingerprints, palm scans or similar data into mathematical codes before storage does not remove