How is employee data protected?
What’s in an employee file? ID, address, bank details, medical reports, criminal records, family details, performance notes. Employee data is one of the most comprehensive and sensitive data groups a business holds. 👥
The employment relationship requires much processing; but special category data and excess information need extra care.
Short answer: process employee data as far as the employment relationship requires, protect special category data separately and strictly, tie access to authority, and inform employees. 🧭
Note: this is general information, not legal advice. Regulations and Board decisions change; see the Turkish Personal Data Protection Authority for current guidance and a lawyer for your specific case.
Four groups of employee data
BU BÖLÜMÜN ÖZETİ
- Identity and contact
- Financial data
- Special category data
- Performance and discipline
Different sensitivity. 🗂️
Identity and contact
For hiring and payroll; necessary. 🪪
Financial data
Bank, salary, deductions; limited access. 💳
Special category data
Medical reports and the like; extra protection and rules. 🔒
Performance and discipline
Evaluations and records; fair and purpose-limited. 📊
Notice and legal basis
BU BÖLÜMÜN ÖZETİ
- Notice at hiring
- The right basis
- Consent pressure
- Extra purposes
Four principles. ⚖️
Notice at hiring
Which data, why, how long; in writing. 📄
The right basis
Most processing rests on the employment contract and legal duties; see the notice and consent guide. 🔗
Consent pressure
Given the power imbalance, whether consent is freely given can be questionable. ⚠️
Extra purposes
Extra uses like promotional photos are assessed separately. 📸
Access and security
BU BÖLÜMÜN ÖZETİ
- An access matrix
- Special data kept apart
- Payroll provider
- Paper files
Four rules. 🔐
An access matrix
Who may see which employee data? In writing. 📋
Special data kept apart
Medical documents in a separate, locked place. 🗄️
Payroll provider
A processor contract with outside providers; see the processors guide. 📑
Paper files
A locked cabinet with limited access. 🔑
Monitoring and proportionality
BU BÖLÜMÜN ÖZETİ
- Company devices
- Location tracking
- Cameras
- Email and messages
Four balances. 🎚️
Company devices
If monitored, prior notice and proportionality. 💻
Location tracking
For field teams, only during working hours and for work; see the archive’s field teams guide. 📍
Cameras
Cameras in work areas, proportionate and with notice; see the CCTV guide. 📹
Email and messages
Rules for monitoring business accounts set in advance. 📧
Four common mistakes
BU BÖLÜMÜN ÖZETİ
- Asking for needless documents
- Everyone accessing files
- Monitoring without notice
- Leavers’ data
All four damage trust. 🚧
Asking for needless documents
Documents unrelated to the job pile up in files. 📁
Everyone accessing files
Salary and medical details circulate in the office. 👀
Monitoring without notice
Monitoring without informing staff is a serious risk. 🕵️
Leavers’ data
Files past their retention period aren’t destroyed; see the retention guide. 🗄️
What should I do today?
BU BÖLÜMÜN ÖZETİ
- Step 1: open an employee file
- Step 2: an access list
- Step 3: the employee notice
- If you want help
Three steps, one hour. 🪜
Step 1: open an employee file
Which documents are there, which are needless? 📁
Step 2: an access list
Who can access employee data? An access matrix draft. 🔐
Step 3: the employee notice
Is there a current employee notice? Check with a lawyer. 📄
If you want help
Let us set up your employee data routine together: use the consult your expert form. For a compliance snapshot of your digital assets see the digital audit; the bigger picture sits on the KVKK consultancy page. 🎯
Related reading from the archive: leave and timesheets · field teams.
📝 Notes From the Field
At one firm employee files sat in a shared folder, visible to many staff including medical reports. An access matrix was prepared, special category documents moved to a separate locked area, job-unrelated documents removed from files, and the employee notice updated. Access to employee data was limited to a few authorised people.
📖 Short Glossary
Special category data: data types like health that the law protects separately. Access matrix: a table of who may access which data. Data processor: an outside provider processing data on the business’s behalf. Proportionality: processing in proportion to the purpose.
⚡ Quick Summary
Employee data is among the most comprehensive and sensitive data groups. 👥 Identity, financial, special category and performance data differ in sensitivity. Employees are informed at hiring; most processing rests on the contract and legal duties. An access matrix, separate special data storage, contracted payroll providers and locked files provide security. Monitoring is disclosed in advance and proportionate.
🎯 Next Step
Let us set up your employee data routine: use the consult your expert form. Candidates sit in the CV guide; for your setup see the digital audit.
Frequently Asked Questions
Sık Sorulan Sorular
Most processing rests on the employment contract and legal duties. Ask a lawyer where consent is needed and about conditions for special category data.
Separately from other documents, in a secure place with limited access. Only necessary people should have access.
It’s kept securely for the statutory retention period, then destroyed.
Source: Turkish Personal Data Protection Authority — guidance and decisions