What is PDKS? Setting up attendance control with KVKK and data security in mind

How does the PDKS process work?

The PDKS process begins by defining the expected working hours for each employee, continues as records are created and gaps are closed, and ends when a day code reaches the attendance ledger. The recording method is only one link in that chain. During setup, the most time goes into deciding who corrects missing and doubtful records, and on what grounds.

1. Define working hours. Put the start and finish times, rest breaks, lateness tolerance and night shifts in writing.
2. Choose a method. Pick one or two methods based on the number of locations, the workforce profile and a personal data assessment.
3. Collect the records. Each record should carry the time, the direction (in or out), the source and the location.
4. Flag the gaps. Days with a clock-in but no clock-out, or unusually long days, should be listed daily rather than left until month end.
5. Correct with a reason. Keep every record added or cancelled by hand together with who did it and why; never delete the original.
6. Pass it to the ledger. Daily working time and attendance status should flow into the puantaj (monthly attendance ledger) automatically.

Which clock-in methods does a PDKS use?

There are five common PDKS methods: card readers, phone-based QR or mobile clock-in, PIN entry, biometric readers, and sign-in sheets or manual entry. None of them suits every workplace. The choice depends on hardware cost, the risk of misuse and the kind of personal data being processed.

What does Turkish law say about PDKS and biometric data?

KVKK (Türkiye's Personal Data Protection Law No. 6698) treats biometric data as special category personal data and, as a rule, prohibits processing it. According to the Personal Data Protection Board, processing biometric data to monitor working hours is not proportionate, even when explicit consent has been obtained.

KVKK Art. 6 allows special category data to be processed only where one of the listed conditions applies. The Board's public announcement (2 June 2026) on its principle decision No. 2026/921 of 29 April 2026 stresses three points: no law expressly provides for monitoring working hours by biometric means; the imbalance of power between employee and employer makes it doubtful that consent is freely given; and biometric processing is not proportionate when less intrusive methods exist.

As alternatives, the announcement points to password-protected card or PIN systems, signed paper attendance sheets, RFID/NFC ID cards, and manual recording overseen by a supervisor. It also states that action will be taken against non-compliant data controllers under Article 18 of the Law. If you already use biometric devices, plan the change with your legal adviser.

On working time, Article 63 of Labour Law No. 4857 generally caps weekly work at 45 hours. If the parties agree, the hours can be spread unevenly across the days, provided no day exceeds 11 hours; over a two-month balancing period, the weekly average cannot exceed normal weekly hours. PDKS records are the basic data for monitoring these limits.

Where does attendance tracking in Excel or on paper break down?

When clock-in data lives on paper, in a spreadsheet or on the device display alone, the trouble appears at month end rather than at the moment of recording. Missing clock-outs are filled in all at once without a reason, and no trace of the correction remains. Because the transfer to the attendance ledger is manual, errors surface only after payroll.

• Forgotten clock-outs are filled in with estimated times at month end, and nobody knows who entered them.
• The device export and the leave list are separate files, so an employee on leave can show up as absent.
• Late arrivals and early departures are never reported, or are checked only after a complaint.
• Exports from several locations arrive in different formats and take days to merge.

How does clock-in tracking work in Sora İK?

In Sora İK, a clock-in record is created when the employee scans a fixed QR code posted at the location with their phone and their position is checked at that moment. Time records from existing card readers are imported as CSV or xlsx files. Sora İK does not process fingerprint or face data and has no live link to card reader manufacturers' systems.

HR gives each location coordinates and a radius; the default radius is 100 metres. If a code leaks, a new one is issued and the old printout stops working. The server's clock sets the time of each record. Raw location, IP address and browser details are not stored; the record holds just two figures in metres: how far the employee was from the location and how accurate the position fix was.

A clock-out with no clock-in, or an in-out pair longer than 16 hours, is flagged as a missing record. HR adds the missing record with a written reason; it carries a “Correction” label and goes into the audit log. A wrong record is not deleted but marked invalid. Daily working time feeds into the attendance ledger automatically.

On the roadmap: correction requests from employees with manager approval, shift planning, overtime calculation and balancing, tracking of field and remote staff, and iOS and Android apps. The product overview is on the Sora İK page. For details: Time & Attendance (PDKS) — full feature list.

What should IT and management watch for?

A PDKS is a network and data-flow project: every record leaving a device or phone reaches a server and can be changed later. So, alongside the choice of method, document where the data comes from, who corrects it and which information is never collected at all. A proportionate method lowers the KVKK risk from the outset.

• Proportionality: choose the least data that serves the purpose. A card or QR code instead of a biometric reader, and a proximity check only at clock-in instead of continuous location, may well be enough.
• Data flow: if records move from the device to the software by file, define who holds the file and when it is deleted. A file transfer does not remove the need to assess the processing done on the device itself.
• Correction trail: keep the right to enter records by hand narrow, and store every correction with a reason and a user name. In Sora İK, a manual record cannot be dated more than 93 days in the past.
• Multiple locations: give each branch its own code and radius, and make sure managers see only their own team. Security measures are summarised in the Sora İK security section.

Modules that work with PDKS

A PDKS record means little on its own; combined with leave, it becomes a day code in the attendance ledger and then feeds payroll. The guides below cover the next steps in that flow and the KVKK side.

• Puantaj guide: The attendance ledger, day codes and a checklist before payroll.
• Annual leave tracking guide: Tracking annual leave through entitlement, balance and approval steps.
• Payroll preparation guide: The four-step payroll cycle in Türkiye, from the attendance ledger to the payslip, with a month-end checklist.
• KVKK in HR guide: KVKK compliance for employee and candidate data: privacy notices, legal bases, retention, destruction and access.

Frequently asked questions

Is a PDKS mandatory in Türkiye?

The legislation does not require any particular PDKS. The Personal Data Protection Authority's announcement also notes that the law sets a framework for employers to track and document working time, but does not specify the method. In practice, you still need a reliable record to monitor overtime and weekly hour limits.

Is fingerprint attendance tracking compliant with KVKK?

Under the Board's principle decision No. 2026/921, processing fingerprint or face data solely to monitor working hours fails the proportionality test, even if the employee has given explicit consent. The Authority lists cards, PINs, paper sheets and supervised manual entry as alternatives. Ask your legal adviser about your own situation.

What is the difference between PDKS and puantaj?

PDKS produces the raw record: who came in and left, on which day and at what time. Puantaj combines that record with leave, sick notes and holidays and gives each day a code meaning worked, on leave, on sick leave or absent. Payroll draws on the puantaj; PDKS data does not go straight into payroll.

How do you correct a missing clock-in or clock-out?

List missing records every day and, once the employee's manager has confirmed the details, have HR complete them with a written reason. Do not delete the original record; mark it invalid. That way an audit can tell which times came from the device and which came from a correction, and you avoid a bulk, unexplained clean-up at month end.

How do you track attendance for remote workers?

Continuous location tracking of remote staff is questionable on proportionality grounds; less intrusive options include a daily work report approved by the manager and supervised manual entry. In Sora İK, remote and field staff tracking is on the roadmap; today HR enters the record of an employee working away from a location as a correction with a reason.