Sora İK · KVKK Compliance Management
KVKK in human resources: a compliance guide for employee data
Last updated: · Yiğit Yalman
In short
HR processes more personal data than any other function: identity, pay, health and family details all end up in the personnel file. For HR, KVKK compliance comes down to four tasks: informing employees and candidates, obtaining explicit consent where needed, keeping data only as long as necessary and limiting access by role.
What are the steps of KVKK compliance in HR?
KVKK compliance in HR starts with writing down which data you process and why, and continues by turning that record into rules people follow every day. The inventory, legal bases, privacy notices, retention periods and access rights depend on each other; a change in one means updating the rest.
- Build an inventory. For personnel, pay, leave, attendance and candidate records, note what you hold, why and where.
- Match each activity to a legal basis. Link every processing activity to a condition in the law; keep explicit consent for activities that have no other basis.
- Inform people. Prepare separate privacy notices for employees and candidates, give them when the data is collected and keep proof that you did.
- Separate special category data. Set a distinct access rule for health, criminal record and biometric data.
- Narrow access. Each role reaches only the records its work requires; views of sensitive data are logged.
- Plan retention and destruction. Set a period for each data type, and delete or anonymise expired records at regular intervals.
- Set up a request channel. Decide who receives and answers requests from employees or candidates.
What personal data does HR process?
HR records an employee's working life from hiring to departure. Alongside identity and contact details, it holds pay, bank, family, health and clock-in records. Under the law, health, criminal conviction and biometric data are special categories of personal data and need stronger protection.
| Category | Example | Watch out for |
|---|---|---|
| Identity and contact | Turkish ID number, address, phone | Do not show ID numbers in full in lists or emails. |
| Pay and finance | Gross pay, bank account, deductions | Limit access to the roles that prepare and approve payroll. |
| Health (special category) | Medical reports, pre-employment examination | Open them with a separate permission; hide the reason for sick leave from team managers. |
| Criminal conviction (special category) | Criminal record certificate | Note in the inventory why you request it; store it under a separate permission. |
| Attendance records | Clock-in and clock-out times, location | Biometric methods create special category data. |
What does KVKK say about employee data?
KVKK (Türkiye's Personal Data Protection Law No. 6698) applies its general rules to employee data too: data is processed for a specific, legitimate purpose, in proportion, kept only as long as needed and protected securely. The employer is the data controller; an HR software provider is, in most cases, a data processor.
| Article | Subject | What it means for HR |
|---|---|---|
| Art. 4 | General principles | Lawfulness, accuracy, a specific and legitimate purpose, proportionality, retention only as long as necessary. |
| Art. 5 | Conditions for processing | Explicit consent is only one of the conditions; a contract, a legal obligation and legitimate interest are also conditions. |
| Art. 6 | Special category data | Health, criminal conviction and biometric data belong here; extra conditions apply, along with adequate measures set by the Board. |
| Art. 7 | Deletion, destruction, anonymisation | When the reason for processing ends, data is deleted, destroyed or anonymised, on the controller's initiative or on request. |
| Art. 10 | Duty to inform | At collection, the person learns the controller's identity, purpose, recipients, method, legal basis and their rights. |
| Art. 12 | Data security | Technical and organisational measures are taken; a breach is reported to the person concerned and the Board as soon as possible. |
| Art. 13 | Applications | The data controller concludes a data subject's application within thirty days at the latest. |
| Art. 16 | VERBİS | Registration in the data controllers' registry before processing; the Board may set exemptions. |
The procedure for deletion and destruction is set by the Regulation on the Deletion, Destruction or Anonymisation of Personal Data. Under the regulation, data controllers obliged to register prepare a retention and destruction policy; the periodic destruction interval cannot exceed six months, and records of deletion, destruction and anonymisation are kept for at least three years.
Sources: Law No. 6698, and the Personal Data Protection Authority's pages on the duty to inform, special category data and VERBİS (the data controllers' registry) (in Turkish).
Where does KVKK compliance break down with Excel and folders?
A compliance set-up built on spreadsheets and folders is accurate on the day it is written, then drifts from real practice. The inventory goes stale, destruction dates are forgotten, and nobody can say who opened which file. In an inspection, the problem is rarely a missing rule; it is being unable to show it was applied.
- The inventory sits in a separate file; when a new form field is added, nobody updates it.
- Leavers' files stay indefinitely; nothing prompts their destruction.
- Personnel documents circulate by email and shared folders; nobody knows how many copies exist.
- A medical report is attached to the leave form, so everyone who sees the form learns the reason.
- A spreadsheet has no row-level permissions; whoever opens the file sees everything, pay column included.
How does Sora İK support KVKK compliance?
For employee data in Sora İK, the customer company is the data controller and Sora İK is the data processor. The KVKK Compliance Management module covers inventory, explicit consent, retention and destruction, and request records; the other modules in use limit access by role and write views of sensitive data to the audit log.
The employer makes the processing decisions; Sora İK helps apply and evidence them. Measures that work today:
- Role-based access: built-in and company-specific roles limit which records each user can reach.
- Sensitive document permission: viewing medical reports and criminal record certificates needs a separate permission; by default, the company owner and HR roles hold it.
- Audit log: changes are recorded with field names; opening pay, payroll, candidate and performance records, downloading documents and exporting data also leave a trace.
- ID number: hidden in lists and from users without permission, and kept out of application logs.
- Team view: in the puantaj (monthly attendance ledger) a manager sees, a day on sick leave looks the same as paid excused leave.
- PDKS (personnel attendance control system): no biometric data is processed; location is used only to verify a QR clock-in, and raw coordinates are not stored.
- Company separation: each company's data is kept apart in the database with row-level security.
Sora İK does not send data to VERBİS; the data controller registers with the registry itself. For plans, see Sora İK pricing. Full scope: KVKK Compliance Management — full feature list.
Which technical measures matter most for HR data?
The Personal Data Protection Authority does not prescribe a single model for data security; measures are chosen according to the nature of the data and the company's risks. For HR data, the priorities are stronger authentication, narrower access, monitored exports and fewer copies outside the system.
- Make two-step verification mandatory for HR and payroll users, and do not use shared accounts.
- Close a leaver's account on their last day, and remove old permissions when someone changes role.
- Review the audit log regularly, starting with out-of-hours exports.
- Do not send payroll or personnel documents as email attachments.
- Sign a data processing agreement with the software provider and ask for its list of sub-processors.
We have gathered firewall, logging, access and backup measures in our KVKK technical measures checklist article; for HR data, the access and logging items come first. Permission design is covered in the HR software security guide, and the legal basis is on the Authority's data security obligations page.
Modules that work with KVKK compliance
KVKK compliance does not live in one module; access rules, personnel records, document management and attendance data all follow the same policy. The guides below cover each of these pieces separately.
- HR software security guide: A vendor-neutral IT checklist for role-based access, two-step verification and audit logs.
- Digital personnel file guide: Document groups, steps for moving from paper to digital and access rules for managing personnel files.
- Employee document and contract tracking guide: Document types, versioning, expiry tracking and access rules for managing employee paperwork.
- PDKS guide: PDKS methods, biometric data under KVKK and handling missing records.
Frequently asked questions
Do employers need employee consent for every type of data?
No. Article 5 of Law No. 6698 lists explicit consent as only one of the conditions for processing; setting up and performing the employment contract, the employer's legal obligations and legitimate interest are separate conditions. Asking for consent where another condition applies suggests the employee has a choice they do not really have. Whether or not consent is needed, the employee is always informed.
When should a former employee's data be deleted?
The law sets no single period; once the reason for processing ends, the data is deleted, destroyed or anonymised. Labour, social security and tax rules create retention reasons that differ by document, so set periods by data type in your retention and destruction policy. For employers required to have such a policy, the periodic destruction interval cannot exceed six months.
Is an HR software provider a data controller under KVKK?
Usually not. Under Article 3 of the law, the data controller is whoever determines the purposes and means of processing; for employee data, that is the employer. A provider processing data on the employer's instructions is a data processor. The contract settles the roles, so ask for a data processing agreement and the sub-processor list. In Sora İK, the customer company is the controller.
Can medical reports be kept in the personnel file?
Article 6 of the law treats health data as a special category. It may be processed where necessary for a legal obligation in employment or occupational health and safety, with the adequate measures set by the Board in place. In practice, keep reports as a separate document type only authorised people can open, and hide the reason from team managers in the leave flow.
What does the Sora İK KVKK Compliance Management module record?
The KVKK Compliance Management module covers four areas: the data inventory, consent records for consent-based processing, tracking the destruction of expired data, and employee requests. Views of sensitive data are kept in the audit log of the Roles, Permissions & Security module. Which data is processed on which basis, and for how long, is decided by the employer as data controller, not by Sora İK.