Face-recognition and fingerprint time-attendance systems look fast, card-free and like a definitive answer to "buddy punching". However, face and fingerprint data are biometric data and count as a special category of personal data under Turkey's Personal Data Protection Law No. 6698 (KVKK). This article explains why the biometric approach needs care and how you can track attendance without processing biometric data. It is general information, not legal advice.

Why Is Biometric Data So Sensitive?

A stolen password or card can be replaced; a face or fingerprint cannot. A leak of biometric data therefore creates a permanent risk. KVKK subjects special-category data to stricter conditions than other personal data and expects additional security measures. Under the principle of proportionality, it is also generally safer to choose a less intrusive method if it achieves the same purpose. Follow the current decisions and guidance of the Personal Data Protection Authority and make the decision with legal support.

Non-Biometric Options

  • RFID / NFC card: Common, fast and inexpensive. A lost card is cancelled and replaced. Its weakness is that it can be handed to someone else.
  • Rotating QR code: A QR code that changes at intervals on the terminal screen is scanned with an app on the employee's phone, making screenshot sharing difficult.
  • Mobile app with location: Suitable for field and site staff. Location is personal data too; use it only at clock-in and clock-out and limited to the defined area.
  • PIN or card + PIN: Asking for a personal code alongside the card discourages card sharing.

How to Prevent Card Sharing

  • Turnstile: A single-person turnstile stops several people passing on one card.
  • Snapshot at passage: Some systems save a photo or short clip at the moment of passage; it is not used for biometric matching and is reviewed only by an authorised person in suspicious cases. This is personal data too, so staff must be informed and a retention period set.
  • Rules and audits: Write card sharing into disciplinary rules and regularly review report inconsistencies, such as a card appearing in two places at once.

If Face Recognition Is Still Chosen

Some businesses may consider biometrics for security reasons. As a general framework, the following matter:

  • Offering an alternative such as a card to employees who do not accept the biometric method,
  • Informing employees clearly and understandably,
  • Storing face data, where possible, as a template on the device rather than as images, and limiting central storage,
  • Defining access rights, retention and deletion periods in writing, and deleting the data of employees who leave,
  • Making the decision with a legal adviser before installation.

Migrating From an Existing System

When moving from a fingerprint or face system to cards, many terminals already include a card reader; otherwise a reader is added or the terminal replaced. The most forgotten step is planning and documenting the deletion of old biometric templates from the devices and software.

For other points to check, see our attendance system selection guide, and for cost our article on attendance system prices.

Pre-Installation Checklist

  • Are the system's purpose and scope defined in writing?
  • Is the reason for the chosen method recorded, compared with less intrusive options?
  • Is the privacy notice for employees ready?
  • Are the retention period and deletion method for attendance records set?
  • Is it defined who can access records and which reports they see?
  • How will data flow into timesheet and payroll software?
  • Which steps close the card and data of an employee who leaves?

Frequently Asked Questions

Is face-recognition attendance prohibited?

It should not be thought of as banned in itself, but because biometric data is special-category personal data it is subject to stricter conditions. A legal assessment should be made before installation.

Is a card-based system also subject to data protection law?

Yes. Clock-in and clock-out times are personal data too; notice, access and retention rules apply to card systems as well. The difference is that no biometric data is processed.

Can I convert my fingerprint system to cards?

In most cases, yes. If the terminal has a card reader a configuration change may be enough; otherwise a reader is added or the terminal replaced. Deleting the old biometric records should also be planned.

To choose the right method for your business together, visit our time and attendance systems page and contact us for a free quote.