TurkeyPersonal Data Protection Law (KVKK), special categories and biometric data
Law No. 6698, Art. 6, as amended by Law No. 7499 ()
In force since .
A sensitive categories rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that captures or processes biometric data, including a voiceprint or faceprint, from a person in Turkey must treat it as special-category data under KVKK Art. 6 and obtain explicit consent or rely on one of Art. 6(3)'s other statutory grounds before processing, even though the Act does not itself define what counts as biometric data.
These lines are LexLint's reading of the law's text. Also read by: Kişisel Verileri Koruma Kurumu (Personal Data Protection Authority of Türkiye), Özel Nitelikli Kişisel Verilerin İşlenmesine İlişkin Rehber (Guide on the Processing of Special Categories of Personal Data), KVKK Publication No. 51, February 2025 (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.kvkk.gov.tr/SharedFolderServer/CMSFiles/70f95c73-06a2-44dc-81e9-34201bdd7f5c.pdf
- Guidance body
- Kişisel Verileri Koruma Kurumu (Personal Data Protection Authority of Türkiye), Özel Nitelikli Kişisel Verilerin İşlenmesine İlişkin Rehber (Guide on the Processing of Special Categories of Personal Data), KVKK Publication No. 51, February 2025
- Open questions
- Does Article 6(1) treat a voiceprint taken to identify or verify a person as biometric data, when Law No. 6698 defines no biometric data and the guide's list of recognition methods (fingerprint, palm, hand geometry, iris, face, retina and DNA) names no voice method, although a migration regulation the guide quotes lists ses taraması ("voice scan") among biometric data for that regulation's own purpose?
What it makes you log
Logging duty
Article 6 prohibits processing special-category data (including biometric and genetic data) except on the listed grounds, and in paragraph 4 requires the adequate measures the Board determines. It does not require the controller to keep a record or log of that processing or of consent, and sets no retention period or inspector.
- Kind
- None
- As of
What this law does
Art. 6(1) lists biometric and genetic data, alongside race, ethnic origin, political opinion, philosophical belief, religion, health, sexual life, criminal convictions, and trade-union or association membership, as special-category data.
Processing requires one of the Art. 6(3) grounds added by the 2024 amendment: explicit consent, a legal provision, vital-interest necessity, the subject's own publication of the data consistent with the subject's intention to make it public, rights establishment, public health necessity, employment or social security law, or a closed list of nonprofit-association member data; the pre-2024 text instead required near-universal explicit consent.
KVKK gives no statutory definition of biometric data, voiceprint, or faceprint anywhere in the Act, so the term must be read inclusively: a voiceprint or faceprint captured for identification falls within the undefined biometric data category and triggers this special-category regime, even though no provision names either modality or sets a biometric-specific retention rule.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .