Is Workplace CCTV Recording Legal in Türkiye? KVKK, Retention and Privacy Notice

Yes, with conditions: workplace cameras need a specific purpose, proportionality and a privacy notice. The KVKK legal basis, prohibited areas, retention period and a privacy notice outline.

Translated from the Turkish original · Türkçe aslı

Yes, workplace camera recording can be lawful, but only under conditions. Footage is personal data; under Law No. 6698, KVKK (Türkiye's Personal Data Protection Law), it requires a specific and legitimate purpose such as occupational safety or site security, use that is limited to and proportionate with that purpose, informing employees, access restricted by authorisation, and retention no longer than necessary. Cameras must not be placed in toilets, changing rooms, rest areas or prayer rooms.

The most up-to-date version of this framework is set out in the Personal Data Protection Authority's public announcement of 8 June 2026, “Public Announcement on Matters to Consider When Using Security Camera Systems in Workplaces”. The notes below bring together that announcement and the relevant decisions of the Personal Data Protection Board from the perspective of an employer and an OHS specialist. We covered the technical architecture of camera analytics in our article on KVKK-compliant computer vision.

We have gathered the steps detailed below into a short checklist for employers:

1. Write a one-sentence, specific and legitimate purpose for each camera location; according to the announcement, abstract purposes such as seeing productivity, increasing discipline or ensuring general control do not count as legitimate purposes.
2. Base each purpose on an appropriate processing condition in the second paragraph of Article 5 of KVKK; explicit consent is a weak basis in this relationship.
3. Test each camera's position and field of view for proportionality; do not place cameras in toilets, changing rooms, prayer rooms or rest areas, and do not record audio unless a lawful justification and necessity have been established.
4. Make the privacy notice two-layered: a sign visible before entering the camera area, and a full privacy notice given to employees in writing.
5. Share camera locations and their purposes before installation with the OHS committee, if there is one, and with the employee representative.
6. Set the retention period according to the purpose and document it with its justification; set up automatic deletion, and keep the recorder's overwrite setting and (if you are obliged to register with the registry) your retention and destruction policy and VERBİS (Data Controllers' Registry Information System) record consistent with it.
7. Prepare an authorisation matrix: live viewing and access to past footage and export should be separate permissions, and every access should be logged under a user name.
8. Resolve an employee's request concerning their own footage within thirty days at the latest; if other people appear in the recording, mask their images.
9. If you are adding AI-based event detection, reassess the purpose, legal basis and privacy notice so that they cover the analytics.

Why is camera footage personal data?

KVKK defines personal data as any information relating to an identified or identifiable natural person. If the frame shows an employee who can be recognised by their face, clothing or the station they work at, the footage is personal data. The Authority's 2026 announcement also explicitly characterises capturing images with security cameras in the workplace as a personal data processing activity.

The employer's framework sits at the intersection of three laws. Article 4 of Law No. 6331 on Occupational Health and Safety (Türkiye's OHS Law) places on the employer the obligation to monitor and check whether the OHS measures taken are being followed. Article 417 of Law No. 6098, the Turkish Code of Obligations, sets out the duty to protect the employee's personality and to take the necessary occupational health and safety measures, while Article 419 provides that an employee's personal data may be used only insofar as it relates to their suitability for the job or is necessary for the performance of the contract. KVKK in turn determines how processing is to be carried out: the general principles in Article 4 (lawfulness and fairness; a specific, explicit and legitimate purpose; being relevant, limited and proportionate to the purpose; retention only as long as necessary), the obligation to inform in Article 10, and the data security obligations in Article 12.

What legal basis does an employer rely on for cameras, and is explicit consent required?

Article 5 of KVKK states that personal data may, as a rule, be processed with explicit consent, but that consent is not required if one of the conditions listed in the second paragraph applies. For workplace cameras, the conditions discussed are mostly two: processing being necessary for the data controller to fulfil a legal obligation (such as the monitoring and checking duty arising from OHS legislation), and processing being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (such as theft, sabotage and site security). The announcement also stresses that an employer may use cameras for obligations arising from these laws, but that the processing must comply with the principles of KVKK.

Explicit consent is a weak basis in this relationship. To be valid, consent must relate to a specific matter, be based on information and be given freely. In its decision dated 04.08.2022 and numbered 2022/797, the Board did not accept as valid a consent form that employees at a factory had been made to sign, listing numerous purposes and data types together, on the grounds that it lacked these elements. In its principle decision dated 29.04.2026 and numbered 2026/921 on the processing of biometric data for attendance tracking, it was also stated that where the option to refuse or withdraw consent is not effectively offered, the freedom of consent must be questioned because of the power imbalance between employee and employer. Basing the cameras on an appropriate processing condition and providing a complete privacy notice is a sounder route than having new hires tick an “I consent to cameras” box.

Is it legal to monitor employees with cameras?

The purpose for which a camera is installed is the first question that determines whether monitoring is lawful. According to the Authority's announcement, ensuring occupational health and safety, preventing workplace accidents, workplace security, and preventing crime and helping to detect it are accepted purposes. By contrast, abstract purposes such as using cameras to see whether employees are working productively, increasing discipline or ensuring general control do not count as a “legitimate purpose”; cameras installed for security should also not be used to monitor attendance or performance.

In practice, this means writing a one-sentence purpose next to each camera in the camera location list. “Monitoring collision risk where the forklift route crosses the pedestrian walkway” is a purpose; “keeping an eye on the site” is not. Opening the same footage later for another purpose, for example to count break times, means going beyond the purpose for which it was installed. A hidden camera, meanwhile, is very hard to reconcile with the obligation to inform; employees must know that the camera exists and what it is for.

Where can cameras not be placed, and can audio be recorded?

Proportionality is tested with three questions: is the camera suitable for achieving the purpose, can the purpose not be achieved by less intrusive means, and is the intrusion proportionate to the benefit gained? According to the announcement, common areas such as entrances, exits and warehouses, and points carrying a security risk such as cash desks, may be considered proportionate, taking into account the camera position and viewing angle. The areas and practices to avoid are:

• Toilets, changing rooms, prayer rooms and rest areas: according to the announcement, cameras should not be placed in these areas.
• Cameras pointed at areas covering toilets: decision 2022/797 states that even though it could not be established whether they were recording, creating a feeling in employees of being constantly watched in a private area was contrary to the principle of good faith.
• Wide-angle or face-focused recording covering every area of the workplace: the announcement asks that this not be done and that the camera's position, viewing angle, zoom capability and frequency of monitoring be assessed.
• Audio recording: the 2026 announcement asks that cameras with audio recording capability not be used unless a lawful justification and necessity are clearly established. In its decision dated 12.03.2020 and numbered 2020/212, the Board also stated that where the expected benefit can be achieved with video alone, without audio, audio recording upsets the balance of proportionality.

Framing matters as much as position. If the camera has a microphone, the cleanest approach is to disable it during installation and record that this was done.

How is the obligation to inform fulfilled, and is a sign enough?

Article 10 of KVKK requires that, when data is collected, the data subject be informed of the identity of the data controller, the purpose of processing, to whom and for what purpose the data may be transferred, the method of collection and legal basis, and their rights under Article 11. The procedure is set out in the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform. The privacy notice is provided in every case, whether or not the processing is based on explicit consent; where explicit consent is obtained, the Communiqué requires the privacy notice and the obtaining of explicit consent to be carried out separately.

For cameras, the practical approach has two layers. The first layer is a sign visible before entering the camera area: that the area is monitored by camera, the name of the data controller, a short statement of the purpose and a way to reach the full text (QR code, short link or reception desk). The second layer is the full privacy notice; it is given to employees in writing when they start work or before the system goes live, and is kept accessible at the entrance for visitors and subcontractor staff. A sign reading only “This area is monitored by camera” does not on its own meet the elements listed in Article 10, because it does not state the purpose, the legal basis or how to make a request.

Alongside the privacy notice, acceptance on the ground is also needed. Camera locations and their purposes are shared before installation with the OHS committee, if there is one, and with the union or employee representative, and what each camera sees is shown on screen. When there is a written commitment that the footage will not be used in performance evaluation and will be limited to the purposes stated in the privacy notice, the system is perceived on site as a safety tool. The same step is repeated for every camera and type of analysis added later.

Camera privacy notice example: an outline to fill in

The fields in square brackets in the outline below are filled in for your facility; the information and outline in this article are for general information only, are not legal advice, and the final text should come from your legal counsel.

Title: [Company name] Privacy Notice on Camera Monitoring. Section one, data controller: under Law No. 6698 on the Protection of Personal Data, the data controller is [company name, address, contact email].

Section two, scope: footage is recorded by cameras in the [entrances and exits, production area, warehouse, loading dock, car park] areas within the boundaries of [facility name]. There are no cameras in toilets, changing rooms, rest areas or places of worship. Audio [is not recorded] by the cameras. [If AI-based event detection is performed on the footage: which events are detected, and that face recognition is not used.]

Section three, purpose and legal basis: footage is processed for the purposes of [monitoring compliance with occupational health and safety measures, preventing and investigating workplace accidents, facility and asset security, and preventing crime and helping to detect it], based on the following conditions in the second paragraph of Article 5 of Law No. 6698: [the condition to be determined with your counsel separately for each purpose; for example, legal obligation for monitoring compliance with OHS measures, and legitimate interest for facility and asset security]. Footage is not used to monitor employees' performance or attendance.

Section four, transfer: recordings may be transferred [to authorised public institutions and organisations upon request; to lawyers and judicial authorities where a legal process requires it; to [company], which maintains the camera system, under a confidentiality obligation].

Section five, method of collection and retention: data is collected automatically through a closed-circuit camera system; recordings are kept for [period] and deleted automatically at the end of that period. If an incident occurs, only the recording relating to the incident is kept for the duration of the legal process. Details are set out in the [Personal Data Retention and Destruction Policy].

Section six, rights and requests: you can submit requests concerning your rights under Article 11 of Law No. 6698 via [written application address, registered electronic mail address or designated email].

How many days are camera recordings kept?

KVKK does not set a single period for camera recordings; frequently quoted figures such as “15 days” or “30 days” have no general legal basis. The rule is the principle in Article 4: data is kept for the period set out in the relevant legislation or for as long as necessary for the purpose for which it is processed. The Authority's 2026 announcement applies this to cameras: retention longer than necessary may constitute a breach of the Law, the shortest possible period should be considered sufficient, and the system should have an automatic deletion mechanism; if an incident occurs, only the recording relating to that incident should be kept for the duration of the legal process.

The question to ask when setting the period is: realistically, how long does it take at this facility for an incident to be noticed and the recording reviewed? The chosen period and its justification should be written down and should match the recorder's overwrite setting. For data controllers obliged to register with the registry, this period should appear consistently in the retention and destruction policy prepared under the Regulation on the Erasure, Destruction or Anonymisation of Personal Data and in the VERBİS record. In some sectors, specific legislation or decisions of security authorities may impose requirements on cameras and retention periods; where such a rule exists, it prevails. We covered the practical way to separate and archive incident footage in our article on video evidence management, and how to set periods by data type in our article on data governance.

Who can access camera recordings, and what security measures should be taken?

Article 12 of KVKK requires the data controller to take all necessary technical and administrative measures to prevent unlawful processing and access and to ensure the data is safeguarded. According to the announcement, an authorisation matrix should be prepared, only authorised persons should access the recordings, and who accesses them and how should be set out in a written procedure.

In practice, this means that live viewing and viewing past footage are separate permissions; the security guard sees the live screen, while only designated people can access past footage and export. Every viewing and export is logged under a user name, and no shared user accounts are used. The recorder is kept in a locked room, default passwords are changed, the device is not exposed directly to the internet, and cameras are kept on a separate network segment; we went into this in detail in our article on cybersecurity in video systems. If an employee makes a request concerning their own footage, it is resolved within thirty days at the latest under Article 13 of the Law; if other people also appear in the recording, sharing it with their images masked protects the rights of third parties.

What should you watch for in AI-powered camera analytics?

Adding AI-based event detection to existing cameras usually means a new processing purpose; the purpose, legal basis and privacy notice should therefore be reassessed so that they cover the analytics. The announcement's emphasis on data minimisation becomes a design rule here: the system should process the event and not identify the person, keep only a short clip of the moment of the event instead of a continuous archive, automatically blur faces in clips where needed, and produce its reports by area, shift and event type. None of the AI for workplace safety applications, such as hard hat and vest checks, entry into restricted areas, falls or forklift-pedestrian proximity, needs identity information.

Face recognition is a separate category. KVKK does not ban face recognition technology by name; however, biometric data obtained through face recognition is special category personal data under Article 6, its processing is prohibited as a rule and is possible only under the strict conditions listed in that article. In decision 2022/797, the Board found the use of face recognition for clocking in and out to be contrary to the principle of proportionality when less intrusive means such as magnetic cards were available; an administrative fine was imposed on the employer and destruction of the biometric data was required. Principle decision 2026/921 likewise established that biometric methods such as fingerprint and face recognition for attendance tracking do not satisfy the principle of proportionality when alternatives such as cards or passwords exist. If production or productivity analytics with cameras is being considered, the announcement's explicit statement on this point must be taken into account: using cameras to see whether employees are working productively does not count as a “legitimate purpose”, and cameras installed for security should not be used to monitor performance. The unit of measurement should therefore be the machine, the station and the process rather than the person, results should not be linked to individuals and should not be used in disciplinary proceedings; the legal basis and proportionality of this purpose should be assessed separately with legal counsel before installation.

How we work when setting up camera analytics

In our default installations at CX Teknoloji, we process footage on an edge server inside the facility, do not send raw video to the cloud (processing can also be done in the cloud if requested) and do not use face recognition; the system keeps a short clip of the moment of the event, and that clip is deleted automatically at the end of a defined period. During the site survey, we document the purpose, field of view, retention period and authorisation matrix for each camera location together with you; this document becomes direct input for your legal counsel's privacy notice and VERBİS update. To find out which analyses your existing cameras are suitable for and to discuss the KVKK questions from the outset, you can get in touch with us; we usually start the assessment with a pilot in a single area.

Frequently asked questions

Do I need employees' explicit consent to install cameras in the workplace?

Rather than relying on explicit consent, employers usually turn to the other conditions in Article 5 of KVKK: the monitoring obligation arising from OHS legislation, or a legitimate interest such as site security. Board decisions question whether employee consent is freely given, because of the power imbalance in the employer-employee relationship. Whichever condition is relied on, employees must be informed under Article 10; your legal counsel determines the appropriate legal basis for your facility.

How many days should camera recordings be kept?

KVKK does not set a single retention period; figures such as 15 or 30 days are not a general legal rule. Recordings are kept for the shortest period necessary for their purpose and deleted automatically at the end of it. According to the Authority's 2026 announcement, if an incident occurs, only the recording relating to that incident is kept for the duration of the legal process. The chosen period should be written into the retention and destruction policy with its justification; if there is a rule specific to your sector, that rule applies.

Can cameras record audio?

Audio recording is considered a more serious intrusion than video recording. In decision 2020/212, the Board stated that where the expected benefit can be achieved with video, audio recording upsets the balance of proportionality. The 2026 announcement also asks that cameras with audio recording capability not be used unless a lawful justification and necessity are clearly established. If your camera has a microphone, it is recommended to disable it and note this in the installation record.

Can camera footage be used as evidence in a dismissal?

A recording obtained lawfully and within the scope of a purpose that employees have been informed of, for example footage of a workplace accident or a theft, may be considered in a dispute. Recordings obtained with a hidden camera, from private areas or for a purpose not considered legitimate, such as performance monitoring, raise questions of unlawfulness. In a specific case, the court assesses the evidence; keeping recordings limited to their purpose from the outset reduces this risk.

Can an employee request their own camera footage?

Article 11 of KVKK gives everyone the right to learn whether personal data about them is being processed and to request information. The request is resolved within thirty days at the latest under Article 13. If other people also appear in the recording, masking their images or sharing only the relevant section is considered in order to protect their rights. If the recordings have been deleted because the retention period has expired, this is stated in the response.

Do AI cameras or face recognition breach KVKK?

AI-based event detection is not unlawful in itself; the conditions of purpose, proportionality and informing apply just as they do for ordinary cameras, and the new purpose should be added to the privacy notice. Face recognition, however, processes biometric data; KVKK does not ban this technology by name, but it treats biometric data as special category data, whose processing is prohibited as a rule and possible only under the strict conditions in Article 6. The Board has found biometric systems for clocking in and out and attendance tracking to be disproportionate when less intrusive alternatives exist.

Is putting up a camera sign enough?

A sign is the first layer of the privacy notice, but on its own it is usually not enough. Article 10 of KVKK requires disclosure of the data controller's identity, the purpose, the recipients of transfers, the method of collection, the legal basis and the rights to make requests. In practice, the sign states that the area is monitored, the data controller, a short purpose and a way to reach the full text (QR code or link); the full privacy notice is also given to employees separately in writing.