Time & attendance systems (PDKS) are used to manage working hours, shifts, leave, and payroll input. However, methods such as fingerprint or facial geometry recognition involve special-category personal data, which places a high compliance and security responsibility on organizations under Turkey's data protection law (KVKK). Just because a method is technically possible doesn't mean it's the most appropriate one from a legal and proportionality standpoint.
Why is biometric data sensitive?
A password can be changed; a biometric trait is a permanent characteristic of a person. In the event of a leak or misuse, it's much harder to remedy. That's why the purpose of processing, the legal basis, necessity, proportionality, retention period, and whether less intrusive alternatives exist should all be evaluated together.
A data-minimization approach
If the purpose of a time & attendance system is simply to confirm that an employee checked in and out at a given place and time, prioritizing methods that achieve that without collecting a biometric template reduces risk. QR codes, device verification, limited and transparent use of location, or controlled in-house terminals can all be evaluated depending on the need.
QR-based tracking with HR Digital
HR Digital lets employees clock in and out via QR, while managing leave, timesheets, and HR processes through a web and mobile app. Being able to build attendance tracking without collecting biometric data like fingerprints supports an organization's data-minimization approach. That said, every organization still needs to build its own processing inventory, privacy notice, access controls, and retention policy.
Technical and administrative safeguards
- Employees should only have access to the data they need for their role.
- Check-in/check-out activity and administrative changes should be logged.
- Data should be deleted or anonymized once the defined retention period ends.
- Mobile device and session security should be maintained.
- Employees should be clearly informed about what data is being processed and why.
A data-protection-compliant time & attendance system isn't just a software feature. It's an ongoing process managed jointly by legal, HR, and information security teams. Organizations should seek expert legal advice for their specific compliance assessment.
Frequently Asked Questions
Is fingerprint scanning required for attendance tracking?
No. Attendance can also be tracked using QR codes, cards, or another method suited to the organization. The chosen method should be evaluated for necessity and proportionality.
Does using QR alone guarantee data protection compliance?
No. QR can remove the need for biometric data, but other obligations — privacy notices, legal basis, access rights, security, and retention periods — still apply.
