Regulations On The Processing And Protection Of Personal Data Under The Labour Law
1. General
When examining the relationship between the protection of personal data and labour law, on the one hand, the employer seeks to employ personnel with suitable qualifications and therefore requires information regarding the applicant’s education, previous workplaces, past professional experience, health conditions, and criminal record. On the other hand, for the purposes of occupational safety and productivity, workplaces are monitored by cameras, security measures are implemented at entry and exit points, and records are kept on computers. Due to the employee’s dependence on the employer, the employee cannot always refuse to provide personal data requested by the employer. It is also necessary for employees acting on behalf of the employer, as the data controller, to be trained in matters of personal data and for a system ensuring data security to be established. These requirements increase the importance of the subject. However, when the Labour Law is examined, it becomes apparent that there are no detailed provisions directly regulating the matter.
2. Employees’ Personal Data and Its Processing
Employees’ identity, address, and occupational details; marital status; place and date of birth; citizenship; criminal record; health information; political or union activities; email correspondence; as well as information regarding religion, race, ethnic origin, or sexual orientation, fall within the scope of personal data. Employers process, use, and in certain circumstances, share employees’ personal data with third parties for purposes such as fulfilling statutory obligations, employee training, occupational health and safety, customer relations, and promotion evaluations.
Article 8 of the Labour Law regulates the form and content of employment contracts. Unless otherwise stipulated by law, employment contracts are not subject to any particular form requirement. However, contracts with a duration of one year or longer must be made in writing. In such cases, personal data must be recorded as the essential elements of the contract (e.g., scope, remuneration, etc.). Pursuant to Article 5/2(c) of the Personal Data Protection Law (KVKK), personal data may be processed without the data subject’s consent if it is necessary for the establishment or performance of a contract to which the data subject is a party.
Article 75 of the Labour Law, titled “Personnel File,” requires the employer to keep a personnel file for each employee. This file must contain the employee’s identity details along with all documents and records required by the Labour Law and other laws. Employers must present these records to the competent authorities upon request. The law also obliges the employer to use such data lawfully and in accordance with good faith principles, and not to disclose information for which the employee has a legitimate interest in maintaining confidentiality.
Article 25 of the Labour Law, titled “Employer’s Right of Immediate Termination for Just Cause,” allows the employer to terminate an employment contract if the employee’s illness is deemed incurable and their continued employment poses a risk, or if illness or incapacity arises due to the employee’s own misconduct, disorderly lifestyle, or alcohol addiction. In such cases, the employer is entitled to access the employee’s health data. Likewise, if the employee misleads the employer during recruitment by providing false information or concealing facts essential to the employment contract (such as qualifications, education, or prior work experience), the employer may terminate the contract for just cause. Accordingly, employers may request personal data such as diplomas, professional licenses, and references prior to hiring.
3. Processing of Employees’ Personal Data under the Turkish Code of Obligations
Article 419 of the Turkish Code of Obligations (TCO) No. 6098 provides: “The employer may use personal data relating to the employee only to the extent necessary for the employee’s aptitude for work or for the performance of the employment contract. Special provisions under other laws remain reserved.” This provision aligns with Article 4/2(ç) of the KVKK, which requires that personal data be processed in connection with, limited to, and proportionate to the purposes of processing.
Thus, under Article 419 TCO, employers may process employees’ personal data only to the extent necessary for the performance of the employment contract and insofar as the data relates to the employee’s suitability for the job. Similarly, pursuant to Article 5/2(c) of the KVKK, personal data may be processed without explicit consent if directly related to the establishment or performance of a contract. In cases of suspected misconduct, employers may also rely on the “legitimate interest” ground for processing personal data under Article 5/2(f) of the KVKK, provided that the employee’s fundamental rights and freedoms are not infringed. Article 63 of the TCO further supports this principle, stipulating that an act may not be deemed unlawful if justified by an overriding legitimate interest. Moreover, Article 417 TCO requires the employer to respect and protect the employee’s personality and to maintain order in the workplace in accordance with the principles of good faith.
4. Constitutional Court Precedent
In its decision on individual application No. 2013/4825, the Constitutional Court addressed the issue of the employer accessing employees’ corporate email accounts containing private correspondence and using these communications as evidence in a reinstatement lawsuit. The applicants alleged a violation of their rights to privacy and confidentiality of communication.
The Court observed that the employees had agreed to abide by the company’s internal regulations and had signed an Information Security Undertaking, which prohibited the personal or improper use of company IT resources and authorized the employer to monitor, back up, review, and restrict such usage without notice. The Court found that the employer had reviewed the email accounts only after being informed by a third party of potentially improper conduct and that the review was aimed at verifying compliance with company rules. Considering the employment contract, internal regulations, and Article 4857 of the Labour Law, the Court held that the employer’s intervention pursued a legitimate purpose and was proportionate. Accordingly, the Court concluded that there had been no violation of the applicants’ constitutional rights under Articles 20 (right to privacy) and 22 (confidentiality of communication).
5. Evaluation of CCTV Recordings and Biometric Data under Data Protection Law
With respect to surveillance cameras in the workplace, the Court of Cassation, 22nd Civil Chamber, in its decision dated 07.05.2019 (E. 2017/21857, K. 2019/9884), held that monitoring employees through electronic means falls within the employer’s managerial authority. However, such monitoring requires prior notification of employees. If employees are monitored secretly without being informed, the data collected—even if it reveals misconduct—must be considered unlawfully obtained. Therefore, dismissals based solely on such data are invalid.
Similarly, the use of biometric systems (such as fingerprint recognition) and CCTV to monitor employees may pose serious risks. Fingerprint data, being unique to an individual, is highly sensitive. Collecting, storing, or disclosing such data can create significant legal and ethical issues. Even when such methods are lawfully used for purposes such as recording attendance, shortcomings in data security measures may still jeopardize employees’ right to the protection of personal data.
Atty. Yalçın TORUN LL.M.
⚠️ WARNING
The copyright of the above written text published on our website belongs to Atty. Yalçın TORUN© 2025 Torun Law Firm – All Rights Reserved.
This article is protected under the provisions of the Law on Intellectual and Artistic Works (No. 5846). The content, in whole or in part, may not be copied, reproduced, published, or shared on any other website without the prior written permission of the author and Torun Law Firm.
This material may only be shared by licensed attorneys, for professional purposes, without any modifications, and with full attribution to the author and the source.
Any unauthorized use may result in legal and criminal liability.