KVKK-compliant employee tracking: location, notices and retention

What kind of data is location?

An employee’s location is personal data, but it is not among the special categories in art. 6 of Law No. 6698 (KVKK); that list is closed and cannot be extended by analogy. This does not mean location can be collected freely: the Board’s decision 2021/1303 held that location data can lead to profiling and to inferring special-category information, so collecting it should be exceptional.

On what legal basis is it processed?

Employers usually think first of explicit consent; but in employment, consent is weak ground. The Board’s principle decision 2026/921 stated that, given the imbalance of power between worker and employer, there is doubt whether consent rests on free will, and that it does not by itself form a sufficient legal basis.

In practice the basis is usually legitimate interest (art. 5/2-f), which requires a written balancing test. Decision 2021/1303 gives four criteria:

• Is the employer’s interest real and worth protecting?
• Can the purpose be achieved only by this processing, or is there a less intrusive way?
• Is the interest clear and present, or hypothetical?
• Are safeguards in place for the employee (limited period, limited access, no off-shift data)?

Proportionality: how much location is enough?

The general principles in art. 4 of the Law require data to be relevant, limited and proportionate to the purpose. In employee tracking that means in concrete terms:

We found no Board decision directly on employee GPS tracking; the assessment above rests on the Law’s general principles and the decisions cited.

The privacy notice: who and how?

The duty to inform (art. 10) belongs to the data controller, i.e. the employer. Under the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, the notice may be given by the controller or a person it authorises, by any means including electronically; the burden of proof is on the controller.

The Board’s principle decision 2026/347 stressed that the privacy notice and the explicit consent text must be drawn up separately. A notice is information; making an employee tick “I have read and approve” does not turn a notice into consent and is a wrong practice.

Retention and destruction periods

Location and photo records are not kept indefinitely. When the purpose of processing ends, data is erased, destroyed or anonymised. Under the Regulation on the Erasure, Destruction or Anonymisation of Personal Data:

• The periodic destruction interval may not exceed 6 months for those obliged to prepare a retention and destruction policy, and 3 months for those who are not.
• The policy obligation applies to those obliged to register with VERBIS. Under the Board’s decision 2023/1154, controllers with fewer than 50 employees a year and an annual balance sheet total below 100 million TL, whose main activity is not processing special-category data, are exempt from registration.
• The exemption does not remove the duty to destroy; it removes only the duty to write a policy.
• An employee’s request about their data must be concluded within 30 days at the latest.

The software provider’s role

A company offering employee tracking software in the cloud is in most cases a data processor; it processes data on the employer’s instructions and on its behalf and cannot use it for its own purposes. Art. 12/2 of the Law says processor and controller are jointly liable for security measures. Although the Law does not expressly require a written processor agreement, the Authority’s Personal Data Security Guide recommends one; given joint liability, it is necessary in practice.

Checklist

• Have we written down which data (clock-ins, location, photos) we process and why?
• If our basis is legitimate interest, have we done the balancing test in writing?
• Is location collected only during working time? Is any off-shift data kept?
• Is the privacy notice ready, separate from consent, and is it recorded who received it and when?
• Is a retention period set for location and photos, and are expired records really deleted?
• Is it limited who can see which employee’s data?
• Is the processor relationship with the software provider in writing?

How our own product answers these questions is set out on the clock-in system page: location is collected only while a shift is open, retention is a company setting and expired records are destroyed.