Duyurular

THE TURKISH PERSONAL DATA PROTECTION BOARD HAS PUBLISHED A PRINCIPLE DECISION ON THE RECORDING OF ID CARD PHOTOCOPIES IN THE TOURISM AND HOSPITALITY SECTOR

The Turkish Personal Data Protection Board (“Board”) published its Principle Decision No. 2025/2120 dated 6 November 2025 titled “Principle Decision on Recording Photocopies of ID Cards of Persons Receiving Accommodation Services in the Tourism and Hospitality Sector” (“Principle Decision”) in the Official Gazette No. 33102 dated 9 December 2025.

The Principle Decision includes the following findings and assessments:

  • It has been determined that the practice of data controllers operating in the tourism and hospitality sector (hotels, motels, holiday resorts, etc.) taking photocopies of guests’ ID cards or scanning and storing them digitally has no valid legal basis. Accordingly, the Board states that this practice must be terminated immediately.

 

  • Under the Identity Notification Law No. 1774 and the Regulation on the Implementation of the Identity Notification Law, data controllers process the identification information of persons receiving accommodation services—name, surname and Turkish ID number—by recording such information.

 

  • Pursuant to the relevant legislation, the processing of identification information is carried out on the basis of Article 5(2)(a) of the Law on the Protection of Personal Data No. 6698 (“Law”) “It is expressly provided for by the laws” and Article 5(2)(ç), “It is necessary for compliance with a legal obligation to which the data controller is subject” and is therefore considered a lawful data processing activity.

 

  • For identity verification purposes, it is sufficient for accommodation facilities to request the presentation of the ID card; however, the act of taking and recording a photocopy of the ID card constitutes excessive data processing. Since this practice lacks a clear legal basis, taking and storing photocopies of ID cards belonging to data subjects is considered unlawful personal data processing under the Law.

 

  • It is further noted that identity documents (particularly the older type of the Turkish ID cards) may contain special categories of personal data, such as religion or blood type. Processing such data through photocopying in the absence of the conditions set out in Article 6 of the Law is unlawful.

 

  • Additionally, it is stated that accommodation facilities may process personal data of guests for invoicing purposes since the provision of accommodation services generally involves a commercial transaction.

 

  • Accommodation facilities must request guests to present their ID cards for inspection without taking photocopies/scans, and may only record manually in their systems the information required under the relevant legislation. In this context, personal data processing carried out pursuant to the Tax Procedure Law No. 213 constitutes lawful data processing within the scope of Article 5(2)(a) of the Law.

 

  • Data controllers are required to destroy all unlawfully obtained or retained ID card photocopies—whether in physical or digital form—in accordance with Article 7 of the Law.

 

  • It is emphasized that, under Article 12(1) of the Law, data controllers must take necessary administrative and technical measures to ensure the lawful processing of personal data, and that failure to comply with the matters set out in the Principle Decision may result in sanctions pursuant to Article 18 of the Law.

 

You can access the full text of the Principle Decision here.

 

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr

 

All information and documents on our website have been prepared by Zumbul Attorneys at Law for general informational purposes only, in accordance with the Attorneyship Law, other relevant legislation and the Professional Rules of Attorneyship of the Union of Turkish Bar Associations. These publications are not intended for advertising or commercial purposes. The information and documents provided are of a general nature and under no circumstances, do they guarantee or warrant that the content is complete, accurate, up-to-date, or reliable. You should not rely on the information and documents on this website without first consulting a lawyer or expert. The links included in our website’s publications are sourced from publicly available materials and are provided solely for the convenience of visitors in accessing additional information. These links do not constitute any form of recommendation or endorsement of the linked persons, institutions or organizations. The information on this website does not in any way constitute legal advice or establish an attorney-client relationship with visitors to the site. All content on this website is the property of by Zumbul Attorneys at Law, and no content may be copied, reproduced, or used without prior written permission.