Human resources is the area where personal data is processed most intensively and most sensitively in any organization. A wide spectrum of data flows through HR processes, from candidate CVs to performance reviews, from medical reports to payroll records. Under Turkey's Personal Data Protection Law No. 6698 (KVKK), each of these data sets must be tied to a specific legal basis, a limited purpose and a defined retention period. This guide aims to simplify HR teams' compliance obligations within a principle-based framework.
The Employee Data Lifecycle
The foundation of compliance is being able to see the data lifecycle end to end. HR data typically passes through five stages:
- Candidate stage: Applications, CVs, references and interview notes.
- Recruitment: Contract, ID, banking and social security details.
- Employment: Payroll, leave, performance, training and health records.
- Offboarding: Releases, exit procedures, references.
- Post-exit retention: Archiving throughout statutory limitation periods.
The data category, basis and retention rationale differ at each stage. The inventory is therefore not a single list but a stage-based map.
Choosing the Right Legal Basis
The most common mistake in HR is basing every operation on explicit consent. Yet because there is a structural power imbalance between employee and employer, it is often hard to argue that consent was freely given. Explicit consent should therefore be a last resort. The correct approach is to match each processing activity with the most suitable basis:
- Performance of a contract: Salary payment, payroll and leave tracking that the employment contract directly requires.
- Legal obligation: Social security filings, tax withholdings, and records required under labor and occupational health-and-safety law.
- Legitimate interest: Corporate security and limited, proportionate monitoring that does not excessively harm employee rights.
- Explicit consent: Only for optional activities that none of the above bases cover (e.g. sharing internal celebration photos).
Informing Candidates and Employees
The disclosure obligation must be met at the moment data is collected. For candidates this is provided in the application form or careers page; for employees, through a separate disclosure notice among onboarding documents. Candidate and employee disclosures should be separate documents, because the data categories, bases and retention periods differ. The notice must set out the data types processed, the purposes, the legal basis, the parties to whom data is transferred, and the rights of the data subject in clear, plain language.
Candidate CV Retention Limits
Retaining the CVs of rejected candidates indefinitely after a position closes violates the principles of purpose limitation and storage limitation. In practice there are two paths: delete or anonymize the data after a reasonable period, or keep it in a talent pool for future consideration with the candidate's explicit consent. Because pooling is optional, explicit consent is an appropriate basis here. Automated destruction processes should trigger at the end of the defined period.
Workplace Monitoring and Proportionality
Monitoring activities such as camera recording, email and internet logging, or entry turnstiles can rely on legitimate interest, but must pass a proportionality test. This test asks three questions: Does the monitoring have a legitimate purpose? Can the same aim be achieved by a less intrusive means? Is the balance preserved between the employee's expectation of privacy and the organization's interest? Employees must be informed of monitoring in advance, and covert monitoring must be avoided.
Managing the Personnel File
Labor law obliges the employer to keep a personnel file for each employee. This statutory requirement does not conflict with KVKK; rather, it forms the "legal obligation" basis. However, only documents necessary for the employment relationship should go into the personnel file, and unnecessary sensitive data (e.g. purposeless health details) should not be kept there. Physical files should be stored in locked environments and digital records in access-controlled systems.
Retention Periods Table
The table below offers a principle-based framework; exact periods should be set according to the limitation and retention requirements in the relevant legislation.
| Data Category | Legal Basis | Retention Principle |
|---|---|---|
| Payroll and financial record | Legal obligation | Throughout statutory limitation |
| Personnel file | Legal obligation | For the relationship + limitation period |
| Camera footage | Legitimate interest | Short and proportionate period |
| Performance review | Performance of a contract | While needed, then destroy |
Implementation Checklist
- Map HR processes stage by stage to a personal data inventory.
- Match each processing activity with a single, correct legal basis.
- Prepare separate candidate and employee disclosure notices.
- Define a candidate CV retention period and set up automated destruction.
- Document a proportionality analysis for monitoring activities.
- Restrict personnel file access on a role basis.
- Put the retention and destruction policy in writing and audit it periodically.
Example Scenario
A technology company receives 80 applications for a software developer role. Three candidates are hired and the remaining 77 are rejected. The HR team transfers the hires' data to the personnel file under the performance-of-contract and legal-obligation bases. Rejected candidates who wish to be considered later are offered a separate opt-in checkbox; those who consent have their CVs held in the talent pool for 12 months, while the data of those who do not consent is anonymized when the process closes. This preserves the talent pool while avoiding any breach of purpose limitation.
Frequently Asked Questions
Can I process an employee's data without explicit consent?
Yes. Most operations required by the employment relationship rest on performance of a contract or legal obligation. Explicit consent should be used only as a last resort for optional operations.
How long can I keep rejected candidates' CVs?
Once the position applied for closes, the purpose of storage ends. You cannot keep CVs indefinitely; you must destroy them within a reasonable time or keep them in a time-limited talent pool with the candidate's explicit consent.
Is camera and email monitoring at work lawful?
It is possible under a legitimate-interest basis, but it must pass the proportionality test, employees must be informed in advance, and covert monitoring must be avoided.
Does keeping a personnel file breach KVKK?
No. The personnel file is a legal obligation arising from labor law and is kept on that basis. You should simply avoid adding unnecessary and purposeless sensitive data to it.
This content is for general information purposes only and does not constitute legal advice.
With JUS. you can manage your HR processes on a single platform with data inventory, disclosure and retention tracking; request a demo.