Special-Category Employee Data in a Foreign-Owned Turkish Company: Article 6 After 2024

Classify the employee information correctly

Article 6(1) of Personal Data Protection Law No. 6698 lists special-category personal data. The list includes health, sexual life, criminal convictions and security measures, biometric and genetic data, trade union membership, and the other political, religious, ethnic and related categories specified in the provision. The legal classification depends on the information contained in the record, not on whether the human resources system labels the document “confidential”.

A personnel file can contain ordinary personal data and special-category data together. The employer should identify the categories at the level needed to understand the processing. An attendance record, a health document and a union-related record do not acquire one common legal basis merely because they are stored in the same employee folder. A document’s title can also conceal additional information in its attachments, comments or supporting correspondence.

The controller must be identified separately from the corporate owner. Foreign ownership does not automatically make an overseas parent the controller for every Turkish employee record. Article 3 directs attention to the entity determining processing purposes and means. Establish the Turkish employer’s role, any service provider’s instructions and any independent purposes pursued by the parent. This role analysis affects both disclosure permissions and the appropriate international transfer arrangement.

Start with a record of the actual fields collected, the source, purpose, users and recipients. The review should cover paper records, payroll applications, shared folders and the operational disclosures that occur outside the formal HR system. A list of software products alone does not reveal which sensitive information managers can access or why that access is necessary.

Identify the Article 6 processing ground

The present Article 6 reflects the 2024 amendment. Its paragraph 3 prohibits processing special-category data unless one of the specified conditions is satisfied. Article 6(3)(f) expressly addresses processing necessary to fulfil legal obligations in employment, occupational health and safety, social security, social services and social assistance. The employer must identify the obligation and explain why the particular information and operation are necessary to fulfil it.

A broad statement that processing is “for HR compliance” does not establish that analysis. Identify the relevant duty, the record required to perform it and the persons who need access. A legal obligation to establish one employment fact does not automatically authorise collection of every underlying document or disclosure of the entire file to all managers. Article 4’s requirement that processing remain related, limited and proportionate applies alongside Article 6.

Other Article 6 grounds can be relevant to distinct operations. Paragraph 3(b) covers express provision by law, while paragraph 3(d) concerns necessity for establishing, exercising or protecting a right. Paragraph 3(e) has its own conditions for specified health purposes and persons under confidentiality obligations or authorised institutions. These grounds should be applied according to their actual conditions; an employer does not become a healthcare institution simply because a file contains medical information.

Explicit consent is one of the grounds in Article 6(3)(a), but it is not a universal replacement for necessity, transparency or security. Article 3 defines explicit consent as relating to a specific matter, based on information and freely given. A signature on a general employment pack should not be described as valid consent for every future sensitive-data use. The processing operation and its genuine legal basis must be identified before selecting the wording given to the employee.

Apply personnel-file duties without overcollection

Article 75 of Labour Law No. 4857 requires an employer to maintain a personnel file for each worker, including identity information and the documents and records required under that Law and other laws. It also requires production to authorised officers and authorities when requested. The provision does not state that every document an employer finds useful becomes a mandatory personnel-file document.

The second paragraph requires the employer to use information about the worker lawfully and in accordance with good faith, and not to disclose information in whose confidentiality the worker has a justified interest. A file’s existence therefore creates responsibilities concerning its use and disclosure. Restrict access according to the function being performed. The legal basis for holding a record and the justification for allowing a particular person to see it require related but separate consideration.

Article 419 of the Turkish Code of Obligations provides that an employer may use employee personal data only insofar as related to suitability for the job or necessary for performance of the employment contract, while preserving special statutory provisions. This rule must be read with Law No. 6698. Job relevance alone does not dispense with the specific Article 6 conditions for sensitive information.

Maintain a document schedule connecting required records to their legal purpose and authorised users. Where an operational decision can be made from a limited result or confirmation, assess whether access to the underlying detailed record is necessary. That assessment should be supported by the applicable employment obligation and the real work process. It should not be replaced by a blanket instruction that every manager may inspect every document in every personnel file.

Separate recruitment, administration and disputes

Recruitment, statutory employment administration and defending an existing employment claim are distinct purposes. The employer should identify the purpose for each sensitive-data operation and revisit it when the record is reused. Information obtained for a statutory employment duty does not automatically become available for unrestricted profiling, commercial analysis or another group company’s independent recruitment programme.

The necessity assessment must address both the data and the proposed use. A lawful reason to receive a particular document does not establish that it should be distributed through an unrestricted email list or retained in a general team folder. Determine which function requires the information, what level of detail it needs and whether the same task can be completed with less information. Document the decision so access permissions reflect the legal analysis.

Article 6(3)(d) recognises processing necessary to establish, exercise or protect a right. An employer relying on that ground for a dispute file should identify the right and the material relevant to it. The existence of one dispute does not support indefinite collection of unrelated sensitive information about the worker or colleagues. Preserve relevant evidence securely and distinguish it from documents whose original purpose has ended.

Article 4 also requires accuracy and currency where necessary. Employment decisions should not rely on a record whose date, status or context has been lost during copying between systems. Keep the source and relevant period visible, and provide a way to correct an established error. Updating an operational field and preserving a historical document for a lawful evidential purpose are different tasks and should be recorded accordingly.

Explain processing to employees accurately

Article 10 requires information at collection about the controller and any representative, processing purposes, recipients and transfer purposes, collection method and legal basis, and the rights in Article 11. A privacy notice should connect the employer’s real practices with those elements. Merely listing every possible provision of Article 6 without identifying its relevance leaves the employee unable to understand the basis of the actual processing.

The notice and any consent request perform different functions. Information about a statutory duty should accurately identify that duty and its limits. A separate optional processing operation requires its own legal assessment and, where consent is relied on, valid consent under the statutory definition. Combining both into a single statement that all processing is compulsory can obscure the distinction and undermine the company’s evidence about its chosen legal grounds.

Recipients should be described consistently with actual access. If an overseas group function receives employee data, the notice should not state that records remain exclusively with the Turkish employer. If a local provider processes data on the employer’s behalf, the arrangement must reflect the provider’s actual instructions and access. An accurate notice supports transparency but does not, by itself, legalise an otherwise impermissible disclosure.

Implement the additional safeguards

Article 6(4) separately requires the adequate measures determined by the Board. The Board’s Decision of 31 January 2018, No. 2018/10 requires a separate, systematic policy and procedure for special-category data. It also addresses staff training, confidentiality agreements, clearly defined access scope and duration, periodic access reviews and immediate removal of the relevant permissions when duties change or employment ends, with recovery of the assets assigned to that employee.

For electronic environments, the decision specifies cryptographic protection, secure separation of cryptographic keys, secure logging of operations, security updates and testing, and appropriate software authorisation. Where remote access is necessary, it requires authentication with at least two stages. A general statement that the company’s cloud provider is secure does not establish that these controls have been implemented for the sensitive employee records concerned.

For physical environments, the decision requires measures appropriate to risks affecting the location and protection against unauthorised entry. Transfer requirements also depend on the medium. The decision addresses encrypted corporate email or registered electronic mail, encryption of removable media with separate key storage, VPN or sFTP for transfers between servers in different physical locations and secure handling of paper documents. Match the actual channel to the applicable requirement rather than relying on a confidentiality footer alone.

Article 12 adds the general duty to take necessary technical and organisational measures and to conduct or commission necessary audits. Where a processor acts for the employer, Article 12(2) preserves their joint responsibility for the paragraph 1 security measures. The employer should therefore obtain evidence about relevant controls and review them against the processing arrangement, including access by support personnel and removal of permissions after the service ends.

Examine overseas parent and group access

An overseas parent’s ownership of the Turkish employer is not an Article 9 transfer mechanism. Identify whether personal data are being sent abroad or made available to an overseas recipient, the recipient’s actual role and the purpose of access. The underlying Article 6 condition must be satisfied, and the transfer must separately meet the applicable Article 9 conditions. Corporate convenience does not collapse those two stages into one.

Our guide to overseas data transfers and standard contracts explains the relevant safeguards. The transfer record must accurately describe special-category data and the additional measures required. A contract covering routine payroll fields should not be assumed to authorise access to an expanded health or union-related dataset without checking its scope and the lawfulness of that processing.

Review the recipient’s onward disclosures and access arrangements as well. Article 9(8) extends the Law’s safeguards and transfer provisions to subsequent transfers. A shared group system therefore requires an understanding of who can access the information and where, including service providers used by the importer. Reducing the dataset or restricting access can be part of implementing proportionality, but the actual transfer still requires its proper legal basis.

Control retention, departure and rights requests

Article 4 requires retention for the period prescribed by relevant legislation or necessary for the processing purpose. Article 7 governs erasure, destruction or anonymisation when the reasons requiring processing cease. Neither provision supports one universal retention period for every employee document. Identify applicable record duties, the continuing purpose and any relevant claim before setting the retention schedule for each category.

Employment ending does not automatically require destruction of every record. It does require reconsideration of active access and ongoing uses. Board Decision No. 2018/10 expressly requires immediate removal of the relevant permissions of staff whose duties change or who leave. Article 12(4) also preserves the prohibition on unlawful disclosure and use outside the processing purpose after duties end.

Employees retain the rights under Article 11 and the application route under Article 13. A correction or deletion request must be assessed against the actual record and legal basis, with a reasoned response and implementation of accepted demands. Our guide to KVKK applications explains that procedure. A lawful retention obligation should be identified specifically; saying “company policy” does not explain why a particular sensitive record must remain.

Build a documented employer review

The final review should connect each sensitive-data category to its purpose, Article 6 ground, source obligation, authorised users, recipients, transfer mechanism and retention period. Attach the current employee notice, relevant provider arrangements and evidence of the additional safeguards. This creates a record that can be checked against actual HR operations rather than a collection of forms that describe different practices.

Resolve mismatches before expanding access or importing more information into a group platform. An updated notice does not cure an unlawful purpose, and a valid transfer contract does not authorise excessive collection. A documented necessity decision, limited access and verified safeguards address different requirements that must operate together throughout the employee-data lifecycle.

Frequently asked questions

1. Is employee health information special-category data?

Yes. Health data are expressly listed in Article 6(1). Other employee records must be classified by their actual contents. Storage in a personnel file does not remove the special-category rules.

2. Is explicit consent always required for sensitive HR records?

No. Current Article 6(3) contains several grounds, including necessity for specified employment and social-security legal obligations in paragraph (f). The employer must satisfy the actual conditions of the ground it uses.

3. Does Article 6(3)(f) cover everything useful to HR?

No. It requires necessity for fulfilment of the specified legal obligations. The employer must identify the duty and show why the particular data and processing are necessary, while respecting Article 4 proportionality.

4. Does Article 75 require every available employee document?

No. It requires identity information and documents and records required under the Labour Law and other laws. It also imposes lawful-use and confidentiality duties. It does not authorise indiscriminate collection.

5. Can a line manager read every medical document in the file?

Access must follow the lawful purpose, necessity and relevant confidentiality requirements. The fact that a document is lawfully held does not automatically justify disclosure to every manager. Access should match the function actually performed.

6. Can the foreign parent rely on ownership to receive the records?

No. Identify the parent’s actual role and purpose, the Article 6 ground and the applicable Article 9 transfer conditions. Group ownership is not an independent overseas-transfer safeguard.

7. Are additional safeguards required when processing is legally mandatory?

Yes. Article 6(4) requires the Board’s adequate measures in addition to a valid processing condition. Decision No. 2018/10 addresses policies, staff, access, encryption, logs and transfer channels.

8. Must access be removed when an HR employee leaves?

Decision No. 2018/10 requires immediate removal of the relevant permissions when duties change or employment ends. Confidentiality and the prohibition on unlawful use continue under Article 12(4).

9. Must all personnel data be erased when employment ends?

No. Examine record duties and continuing lawful purposes by category. Unnecessary active access should end, while lawful retention and eventual erasure, destruction or anonymisation follow Articles 4 and 7.

10. Does a privacy notice itself make sensitive-data processing lawful?

No. Article 10 transparency is a separate duty. The employer also needs a valid Article 6 condition, compliance with Article 4, the required safeguards and any applicable transfer conditions.