Employee Personal Data

At every stage of employment, employers process the personal data of employees and candidates: CVs, identity and contact details, payroll and bank details, performance reviews, medical reports, attendance records and personnel file documents. These processing activities are subject to the Personal Data Protection Law No. 6698 (KVKK).

Legal Bases

Most employee data processing relies on the following legal bases:

• Conclusion and performance of the employment contract (payroll, leave tracking),
• The employer’s legal obligations (tax, social security, occupational health and safety),
• The employer’s legitimate interest (performance management, workplace security).

Because of the power imbalance in employment, explicit consent obtained from employees is open to question as to whether it is freely given; another legal basis should be relied on where possible.

Special Category Data

Medical reports, biometric data (fingerprint entry systems), trade union membership and criminal records are special categories of personal data subject to stricter rules. Health data required by occupational health and safety legislation may be processed, but access should be restricted to a limited number of people such as the workplace physician.

Notice and Inventory

Separate privacy notices should be prepared for employees and candidates, and which data is processed for which purpose should be shown in the personal data inventory. Sharing employee data with payroll providers, insurers and group companies should be assessed separately.

Retention and Departure

Personnel file documents may be kept after employment ends for the limitation periods and periods under social security legislation, and must be disposed of when the period expires. Giving another employee access to a departing employee’s corporate mailbox also requires separate assessment; see Can the Corporate E-mail Histories of Employees Who Leave Their Jobs Be Made Available to Another Employee?. For monitoring employees, see Employee Monitoring.