Biometric Data

Also known as: Fingerprint Data, Facial Recognition Data, Biyometrik Veri

In short

A special category of personal data resulting from specific technical processing of a person's physical, physiological or behavioural characteristics, such as fingerprints, facial geometry, iris or voice, that uniquely identifies them.

Biometric data is data resulting from specific technical processing of a person’s physical, physiological or behavioural characteristics that allows or confirms their unique identification. Fingerprints, facial geometry, palm vein patterns, iris and retina scans, voiceprints and signature dynamics are typical examples. Article 6 of the KVKK lists biometric data among the special categories of personal data.

Photographs vs Biometric Data

A person’s photograph or camera recording is personal data on its own, but not always biometric data. An image becomes biometric data when processed by software aimed at automatically recognising or verifying the person, for example when a facial map is extracted and compared with a database. The Authority’s Guide on Matters to Consider in Processing Biometric Data explains this distinction in detail.

Processing Conditions and Proportionality

Since the 2024 amendment, biometric data may be processed on one of the conditions listed in Article 6 of the KVKK; legitimate interest is not among them. Having a condition is not enough on its own: the processing must also be relevant, limited and proportionate to its purpose.

In many decisions, the Board has found fingerprint or facial recognition attendance tracking to breach the principle of proportionality where the same purpose could be achieved with less intrusive methods such as card access. Because of the imbalance of power between employer and employee, whether explicit consent obtained from employees is freely given is often questionable. If a biometric system is used, an equivalent alternative must be offered to those who do not accept it.

Measures to Take

Biometric templates should be encrypted and kept separately from other personal data.
Where possible, irreversible templates rather than raw images should be stored, and data should be kept on the individual’s card or device rather than on a central server.
Access rights should be restricted and the adequate measures set by the Board for special categories should be taken.

Frequently Asked Questions

Can we install a fingerprint entry system at the workplace?

If the same purpose can be achieved with less intrusive methods such as cards or passwords, fingerprint or facial recognition attendance tracking may be found to breach the principle of proportionality. A biometric system should be considered only where the security need is genuinely high, and an alternative should be offered.

Is a photograph always biometric data?

No. A photograph is personal data, but to be biometric data it must undergo specific technical processing aimed at uniquely identifying the person, such as facial recognition software.

← Glossary A–Z