Is CCTV and employee monitoring in the workplace compliant with the Personal Data Protection Law (KVKK)?

Entrance

The use of security cameras in workplaces, tracking employee entry and exit, vehicle tracking systems, monitoring computer usage, overseeing work emails, and controlling attendance using fingerprint or facial recognition systems has become quite common today. Employers may use various tracking and monitoring systems to ensure workplace security, prevent theft and irregularities, fulfill occupational health and safety obligations, control production processes, or measure employee performance.

However, the employer's right to manage is not unlimited. An employee's presence at the workplace does not mean their privacy is completely eliminated. Even while working, an employee can demand the protection of their personal data, respect for their privacy, and freedom from excessive surveillance. Therefore, when implementing camera surveillance and employee monitoring in the workplace, the Personal Data Protection Law No. 6698, labor law principles, and the right to privacy and personal rights guaranteed by the Constitution must be considered together.

The Personal Data Protection Authority, in its announcement regarding the use of security cameras in workplaces, stated that factors such as camera location, viewing angle, monitoring frequency, recording duration, employees' reasonable privacy expectations, audio recording, unauthorized access, and storage duration should be carefully considered. The Authority also emphasized the need to inform employees and fulfill the obligation to provide information under Article 10 of Law No. 6698.

Therefore, it is not accurate to give a single-word answer to the question "Is it forbidden to record with cameras in the workplace?". Recording with cameras in the workplace may be legal under certain conditions. However, the use of hidden cameras, audio recording, monitoring private areas such as restrooms and changing rooms, continuous and excessive surveillance of employees, or recording without properly informing employees may result in violations of the Personal Data Protection Law (KVKK) and personal rights.

Is workplace camera recording considered personal data processing?

Yes. Camera recording in the workplace means recording the image of an employee or third parties visiting the workplace. Since this image recording makes the person directly or indirectly identifiable, it constitutes personal data. According to Law No. 6698, personal data is any information relating to an identified or identifiable natural person. Images, audio, vehicle license plates, entry and exit times, IP addresses, location information, biometric records, and performance data can also be considered personal data depending on the specific circumstances.

Therefore, installing a camera system in the workplace is not merely a technical or security matter. It is also a personal data processing activity under the Personal Data Protection Law (KVKK). The employer acts as the "data controller" in this regard. Since the employer decides where the camera system will be installed, for what purpose it will be used, how long the recordings will be stored, who will have access to them, and with whom the recordings will be shared, the responsibility under the KVKK also lies with the employer.

In this context, the employer must first answer the following questions: What purpose will the camera serve? Is the camera truly necessary? Can the same purpose be achieved with a less intrusive method? Is the area being recorded one where employees have high expectations of privacy? Is audio being recorded? How long are the recordings stored? Who has access to the recordings? Have employees and visitors been informed?

If these questions cannot be answered legally, workplace camera recordings may become a violation of the Personal Data Protection Law (KVKK).

Employer's Right to Manage and Employee's Right to Privacy

The employer has the right to manage the workplace, supervise the conduct of work, ensure occupational safety, and check whether employees fulfill their work obligations. This right is referred to as the employer's right to manage. However, the right to manage cannot be used in a way that infringes upon the fundamental rights and freedoms of the employee.

An employee's presence at the workplace does not mean that the employer can constantly monitor them, record their every move, or inspect their private space. Employees also have a reasonable expectation of privacy in the workplace. For example, while the use of cameras for security purposes is more easily justified in areas such as production areas, cash registers, warehouses, or building entrances; monitoring locker rooms,休息 areas, restrooms, prayer rooms, medical rooms, or areas where employees spend their private time poses significant legal risks.

The Personal Data Protection Authority also states that when cameras are used in the workplace, employees' reasonable expectation of privacy should be taken into account; that the severity of the intervention increases as the scope of monitoring expands; and that wide-angle or face-focused recordings covering all areas may be problematic in terms of proportionality.

Therefore, employers cannot operate with the attitude of "it's my workplace, I can put cameras wherever I want." A purpose, necessity, and proportionality assessment must be conducted for each camera.

Under what conditions is workplace camera recording compliant with the Personal Data Protection Law (KVKK)?

For workplace camera recordings to comply with the Personal Data Protection Law (KVKK), the general principles set forth in Law No. 6698 must first be adhered to. Personal data must be processed lawfully and fairly, collected for specific, explicit, and legitimate purposes, be relevant, limited, and proportionate to the purpose for which they are processed, kept accurate and up-to-date when necessary, and retained for the required period. These principles apply directly to camera recording and personnel tracking systems.

If a camera system is installed for security purposes, the cameras should only be positioned to serve that purpose. For example, security concerns may be stronger in areas such as the entrance/exit doors of the workplace, the goods receiving area, the cash register area, or the warehouse. Conversely, a camera system that zooms in on desks where employees constantly sit, records facial features, or monitors employees in detail throughout their entire day may be considered excessive.

The following conditions are important in determining the legality of camera recordings:

First, a legitimate and specific purpose . The employer should use the camera system for clear purposes such as ensuring workplace safety, preventing theft, detecting workplace accidents, or protecting facility security, not for vague purposes like “general control” or “monitoring personnel.”

Secondly, the principle of proportionality must be ensured. The camera system should be necessary for the intended purpose and should not interfere unnecessarily with employees. If a security guard, card entry system, or limited-time supervision is sufficient in an area, continuous and detailed camera surveillance may be disproportionate.

Thirdly, the obligation to inform must be fulfilled. Employees and visitors must be aware that camera recordings are being made at the workplace, the purpose for which these recordings are processed, who can access them, how long they will be stored, and their rights. The obligation to inform is not dependent on a request from the data subject; it must be fulfilled by the data controller in every case where personal data is processed.

Fourth, access to recordings should be restricted. Camera recordings should not be accessible to everyone. Access should be limited to authorized personnel only; who views the recordings, when they are viewed, and for what reason should be monitored.

Fifthly, the retention period must be reasonable. Retaining camera recordings indefinitely or for an unnecessarily long period may constitute a violation of the Personal Data Protection Law (KVKK). The institution states that the shortest possible retention period should be preferred for camera recordings and that an automatic destruction mechanism should be in place in the system. In the event of an incident, only the relevant recordings may be retained for the duration of the legal process.

Is it necessary to obtain explicit consent from an employee for camera recording?

It cannot be said that explicit consent must be obtained from employees in every case for workplace camera recording. In the KVKK (Personal Data Protection Law) system, explicit consent is only one of the conditions for processing personal data. Article 5 of the Law regulates conditions for processing personal data other than explicit consent. For example, reasons such as being explicitly provided for in the laws, the fulfillment of a legal obligation by the data controller, the establishment or protection of a right, and legitimate interest may allow the processing of personal data without explicit consent.

The use of security cameras in the workplace can often be justified on legal grounds such as the employer's legitimate interest, occupational health and safety obligations, workplace safety, or the protection of a right. However, this does not mean that the employer can conduct unlimited surveillance. The obligation to inform continues even without explicit consent. Furthermore, data processing activities must be proportionate, necessary, and appropriate to the purpose.

The crucial point to note here is that the power balance between employer and employee is not equal. An employee may feel compelled to consent out of fear of losing their job. Therefore, whether the explicit consent obtained from the employee is truly based on free will may be debatable. For this reason, employers should base continuous monitoring activities, such as camera recording, not on explicit consent but on appropriate legal grounds stipulated in the law; however, in all cases, they must inform the employee in a clear, understandable, and verifiable manner.

Furthermore, if there is a specific activity requiring explicit consent, the information text and the explicit consent text should be prepared separately. The Personal Data Protection Board's announcement regarding its principle decision dated February 18, 2026, and numbered 2026/347, stated that intertwining explicit consent and information texts is one of the frequently encountered legal violations.

Is it permissible to use hidden cameras in the workplace?

The use of hidden cameras in the workplace generally carries serious legal risks. If employees are not informed, are unaware of the camera's presence, and are constantly being recorded, violations of the Personal Data Protection Law (KVKK), the right to privacy, and personal rights may arise.

Hidden cameras can only be discussed in extremely exceptional circumstances, when there is concrete and strong suspicion, and when it is impossible to obtain evidence through other methods, and only for a short and limited period. However, such practices are not considered lawful in every case. An employer's arbitrary installation of hidden cameras to monitor employees' private areas or to secretly record for general surveillance purposes may lead to unlawful consequences.

The use of cameras, especially in areas such as restrooms, changing rooms,休息 areas, places of worship, or medical rooms, can constitute a serious violation. In most cases, an employer citing security reasons will not be sufficient, as employees have extremely high expectations for privacy in these areas.

Is recording audio in the workplace legal?

Recording video footage and recording audio in the workplace are not the same thing. Audio recording can constitute a more serious interference with privacy and freedom of communication than video recording. Continuously recording employees' conversations, interactions with customers, or private dialogues poses significant legal risks.

The Personal Data Protection Authority states that cameras with audio recording capabilities are a highly intrusive method of privacy and should not be used unless the necessity is clearly demonstrated with a legally justifiable reason.

Therefore, audio recording in the workplace should be evaluated much more strictly than video recording. For example, recording customer conversations within the scope of quality control or contractual relationships in call center operations may be evaluated on a separate legal basis. However, continuously recording employee conversations within the office, chats in休息 areas, or general sounds in the work environment may be considered excessive and unlawful.

It is not correct for an employer to act on the assumption that "there are already cameras, so they can record audio as well." Audio recording must also be considered in terms of purpose, legal basis, necessity, proportionality, and adequate information.

Is the Employee Tracking System compliant with the Personal Data Protection Law (KVKK)?

Personnel tracking systems are not limited to camera recordings alone. Card access control systems, fingerprint scanning, facial recognition, vehicle GPS tracking, computer usage reports, internet access logs, email monitoring, shift tracking software, location tracking via mobile applications, and performance tracking systems can also be considered within the scope of personnel tracking.

Each of these systems constitutes a personal data processing activity. Therefore, the employer must conduct a separate analysis of the purpose, legal basis, and proportionality for each tracking system. While using a card-based access control system to track entry and exit in a workplace may be considered reasonable, using systems that process biometric data such as fingerprint or facial recognition for the same purpose could constitute a more serious intrusion.

Biometric data, in particular, is considered special categories of personal data. Therefore, systems such as fingerprint, palm scanning, facial recognition, or retina scanning are subject to stricter legal requirements. Employers cannot process biometric data simply because it is practical or convenient. If the same purpose can be achieved through a less intrusive method, the use of biometric systems may be considered contrary to the principle of proportionality.

Personnel Tracking with Vehicle Tracking System and GPS

The use of GPS tracking systems in company vehicles is common, especially for field personnel, cargo, logistics, service, sales, and technical teams. Employers may use vehicle tracking systems for purposes such as vehicle security, fuel monitoring, route planning, work organization, or customer service. However, for these systems to comply with the Personal Data Protection Law (KVKK), employees must be clearly informed.

Vehicle tracking systems should be limited to working hours and should not become a tool for monitoring an employee's private life. If a vehicle assigned to an employee is also provided for private use, continued location tracking outside of working hours poses a serious risk to privacy. Therefore, employers should clearly regulate the hours during which the vehicle tracking system is active, what data it collects, who has access to this data, and how long the data is stored.

For example, an employer processing location data solely to prevent vehicle theft or to organize work is not legally equivalent to an employer monitoring an employee's movements throughout the day, including which streets they frequent, how long their breaks are, and where they go outside of working hours. In the latter case, constant surveillance pressure may be exerted on the employee, violating the principle of proportionality.

Computer, Internet and Email Monitoring

Computers, corporate email accounts, and internet access provided to employees in the workplace are part of the employer's organizational structure. Therefore, the employer can exercise a certain degree of oversight. However, this oversight is not unlimited.

Employers may implement certain technical controls to prevent misuse of workplace computers, leaks of company secrets, downloads of malicious software, or unlawful use of workplace resources. However, continuous and unlimited access to all employee correspondence, private messages, personal accounts, or private files may be unlawful.

One of the most important requirements in this area is that the employer establishes a clear policy in advance. Employees should be informed about the purposes for which workplace computers can be used, whether personal use is prohibited, whether email accounts will be monitored, whether internet access logs will be kept, and under what conditions monitoring will be carried out.

Inspections conducted without proper notification, internal policy, and reasonable expectations for employees can lead to legal disputes. An employer's inspection authority cannot be used to pressure an employee, excessively interfere with their private correspondence, or intrude on their personal space out of mere curiosity.

How long can camera recordings be stored?

According to the Turkish Personal Data Protection Law (KVKK), personal data must be stored for only as long as is necessary for the purpose for which it was processed. Indefinite storage of camera recordings is also not legally permissible. When determining the storage period, the nature of the workplace, security needs, the time it takes to detect incidents, legal obligations, and the principle of proportionality should all be considered together.

The Personal Data Protection Authority states that storing camera recordings for longer than necessary may constitute a violation of the law, and that the shortest possible storage period should be considered sufficient. Furthermore, it is stated that the system should have an automatic destruction mechanism and that, in the event of an incident, only the relevant recordings should be kept for the duration of the legal process.

Therefore, it is problematic for employers to routinely store camera recordings for months or years. In practice, shorter retention periods should be preferred depending on the risk level of the workplace. However, if a concrete event such as theft, workplace accident, disciplinary investigation, lawsuit, or criminal investigation has occurred, it may be possible to retain only the recordings related to that event for a longer period due to their evidentiary value.

Who has access to the camera recordings?

Access to camera recordings should be restricted. Not every manager, employee, or department in the workplace should be able to view camera footage. Access should only be granted to a limited number of individuals who require it for their specific duties. For example, personnel from the security unit, administrative affairs manager, legal department, or certain individuals from senior management could be authorized.

Sharing recordings with unauthorized persons, publishing employees' images on social media, circulating them in WhatsApp groups, or using them for purposes other than those intended may constitute a violation of the Personal Data Protection Law (KVKK). The Personal Data Protection Authority also states that camera recordings should not be shared with unauthorized persons without permission and that only authorized persons should have access to the recordings.

Therefore, the employer needs to establish an access policy for camera recordings. It should be clearly defined who can view which recordings, under what circumstances recordings may be shared with external agencies, how to proceed in case of requests from law enforcement or courts, and how the recording viewing process will be logged.

What are the rights of employees?

Employees are considered "data subjects" under the Personal Data Protection Law (KVKK) because their personal data is processed. Therefore, employees have the right to inquire with their employer whether their personal data is being processed, to request information regarding this processing if it is, to learn the purpose of the processing and whether it is being used appropriately, to know the third parties to whom it has been transferred, to request the correction of incomplete or inaccurate data, and to request its deletion or destruction if the conditions are met.

The employer must respond to the employee's application within the specified time frame. Otherwise, the employee may file a complaint with the Personal Data Protection Authority. Furthermore, an employee whose personal rights have been violated due to unlawful data processing may also claim material or moral damages, depending on the specific circumstances of the case.

The important point here is that the employee doesn't have to be an active employee. Former employees also retain their rights under the Personal Data Protection Law (KVKK) regarding camera recordings, personnel files, performance data, email records, or disciplinary records held by the employer.

A Guide to Camera and Personnel Monitoring in Compliance with GDPR for Employers

To comply with the Personal Data Protection Law (KVKK), employers must first create an inventory of all monitoring and tracking activities in the workplace. This includes identifying which areas have cameras, what the cameras record, whether audio recordings are made, how long the recordings are stored, who has access to them, and under what circumstances they are shared.

Separate information notices should then be prepared for employees, visitors, and, if necessary, customers. Information signs should be placed in easily visible locations where cameras are located, indicating how to access the detailed information notice. However, simply stating "there are cameras in this area" is often insufficient. The purpose for which personal data is processed, the identity of the data controller, how to exercise rights, and the retention period of records should also be clearly explained.

Employers must act in a way that allows them to prove that their obligation to inform has been fulfilled. According to the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, the burden of proof that the information has been provided rests with the data controller. Furthermore, if the purpose of personal data processing changes, separate information must be provided for the new purpose.

In addition, an internal policy should be developed for camera and personnel tracking systems, access rights should be restricted, recordings should be stored for the shortest possible time, an automatic deletion system should be established, and employees should receive GDPR training. If the employer wants to use camera recordings as evidence in disciplinary or termination proceedings, they must ensure that the recordings were obtained legally. Recordings obtained illegally may also be a subject of dispute in labor law cases.

Conclusion

Workplace camera recording and employee monitoring may be compliant with the Personal Data Protection Law (KVKK) under certain conditions. However, this requires the employer to have a legitimate purpose, the monitoring activity to be proportionate, the privacy expectations of employees to be taken into account, the obligation to inform fully fulfilled, the recordings not to be stored for unnecessarily long periods, and not to be shared with unauthorized persons.

An employer's right to manage does not give them the right to monitor employees without limits. Employees can demand the protection of their personal data and respect for their privacy in the workplace. Practices such as hidden cameras, audio recording, biometric tracking, off-hours GPS monitoring, and monitoring of private areas carry serious legal risks.

In conclusion, before installing camera and personnel monitoring systems in the workplace, a compliance analysis with the Personal Data Protection Law (KVKK) should be conducted; the purpose, legal basis, proportionality, retention period, access permission, and obligation to inform should be evaluated separately for each system. If this process is not carried out correctly, the employer may face complaints to the Personal Data Protection Authority, administrative fines, compensation claims, and labor law disputes. A properly conducted KVKK compliance process, on the other hand, both meets the employer's security and control needs and protects the fundamental rights and freedoms of employees.