Home About Us Services Awards Team Insights Career Contact Us TÜRKÇEENGLISH Devin Law & IP — Istanbul
← All Insights
CategoryData Protection
Published18 June 2026
Authors
Uğurcan TekinPartner
İnci ÖzçilsalAttorney at Law
Beyza ErdemirAttorney at Law

Workplace CCTV Systems: The Authority's Public Announcement of 8 June 2026

On 8 June 2026 the Personal Data Protection Authority published its Public Announcement on Matters to be Observed in the Use of Security Camera Systems in Workplaces, thereby sharing with the public its current approach to personal data processing carried out through workplace camera systems.

Although at first sight the Announcement appears to be neither a legislative amendment nor a binding principle decision, its significance lies in the fact that it brings together, systematically and in a single text, the principles that have taken shape in recent years through Board decisions, Council of State case law and the framework of European data protection law. In this respect the Announcement is not merely an informative statement for data controllers; it is a current compliance guide indicating that existing practices require reassessment.

The use of security cameras in workplaces has long been one of the areas requiring a delicate balance to be struck between the employer's right of management, occupational health and safety obligations, the need for workplace security, and employees' fundamental rights and freedoms. Employers plainly have legitimate interests in protecting the workplace, employees, visitors, production processes and company assets. Nevertheless, the presence of employees at the workplace does not mean that their private lives and personal data become entirely unprotected, or that they may be kept under continuous observation.

“The Authority has drawn a clear distinction between camera use for security purposes and surveillance activities directed at monitoring employees' performance, efficiency or conduct.”

The most important aspect of the approach set out in the Announcement is precisely this distinction. While the Authority accepts that cameras may be used for purposes such as ensuring workplace security, assisting in the prevention and detection of crime and fulfilling occupational health and safety obligations, it expressly states that purposes such as seeing whether employees are working efficiently, increasing discipline, exercising general control or monitoring employee performance cannot be regarded as falling within the scope of a legitimate purpose.

Within this framework, the Announcement establishes that employers must now be able to answer not only the question of why the camera system was installed, but also how the system is actually used, which areas it covers, for what periods it retains recordings, who has access to it, and what surveillance effect it creates upon employees.

Accordingly, the Announcement does not mean that the use of security cameras in workplaces is entirely prohibited; it does establish that the use of camera systems beyond their security purpose, as an instrument of employee surveillance or performance monitoring, gives rise to serious legal risk under the Personal Data Protection Law. Data controllers should therefore reassess their existing camera systems in terms of purpose, scope, access authorisations, retention periods and the principle of proportionality.

The Existing Legal Framework for Camera Use in Workplaces

The use of security camera systems in workplaces constitutes one of the most visible examples of the impact of technological development on working life and fundamental rights. Camera systems, formerly used principally to control building entrances and exits, to prevent theft and sabotage risks, to protect production facilities against external threats and to ensure workplace security, are today equipped with far more advanced technical features.

High-resolution imaging technologies, remote access capabilities, motion analysis, facial recognition systems, artificial-intelligence-assisted tracking mechanisms, audio recording features and extensive recording infrastructures have made it possible for employers to process far more intensive data concerning employees, visitors and activities within the workplace. While this technological transformation provides significant advantages in terms of security and operational oversight, it has also brought new legal debates regarding employees' private lives, the protection of their personal data and their expectation of privacy in the workplace.

“The fact that an employee is present at the workplace does not mean they may be observed continuously and without limit; modern data protection law accepts that a reasonable expectation of privacy exists at the workplace as well.”

For this reason, in assessing camera use in workplaces, regard must be had not only to the employer's right of property, right of management or need for workplace security, but also to employees' constitutionally guaranteed rights to respect for private life and to the protection of their personal data.

The balance between the employer's right of management and the employee's reasonable expectation of privacy.

The Normative Bases

Several normative sources must be assessed together in striking this balance in Turkish law. Article 20 of the Constitution provides that everyone has the right to demand respect for their private and family life, and places the protection of personal data under constitutional guarantee; that guarantee retains its validity within the employment relationship.

Under Law No. 6698, the recording of images through camera systems is plainly a personal data processing activity. For that activity to be regarded as lawful it must first rest on one of the processing conditions in Article 5. In practice, workplace camera use is most often associated with the legitimate interest of the data controller, the fulfilment of a legal obligation, or the necessity of processing for the establishment, exercise or protection of a right. The existence of a processing condition is not, however, sufficient on its own: camera recording must also comply with the general principles in Article 4 — processing in accordance with the law and good faith, limitation to specified, explicit and legitimate purposes, relevance, limitation and proportionality to the purposes, and retention only for the period required.

Article 417 of the Turkish Code of Obligations is also significant. Under that provision the employer is obliged to protect and respect the personality of the employee in the employment relationship. The employer's duty of care is not limited to ensuring physical safety; it extends to the protection of the employee's personality rights and moral integrity. The employer is therefore expected to install a camera system that does not damage the employee's personality rights, does not make them feel under constant pressure and does not interfere disproportionately with their private life.

Law No. 6331 on Occupational Health and Safety imposes various obligations on employers regarding the provision of health and safety at the workplace, the prevention of risks and the monitoring of compliance with the measures taken. In some workplaces camera use may accordingly be assessed as part of occupational health and safety measures — particularly in hazardous production areas, warehouses, dispatch, loading and unloading zones and in relation to machinery and equipment safety. Even there, however, the monitoring must remain limited to the occupational health and safety purpose and must not become an instrument continuously supervising employee performance or conduct.

In conclusion, camera use in workplaces is not an absolutely prohibited activity. Nor, however, is it a technical preference on which the employer may decide without limit within the scope of a unilateral right of management. In every concrete case, the purpose, scope, placement, technical features, retention period, access authorisation and effect upon employees must be assessed together.

Camera placement, retention periods and notice signage are assessed together, not separately.

The Approach Before the Announcement: Board and Judicial Decisions

In order to understand the significance of the Announcement of 8 June 2026, it is necessary to examine the approach previously developed by the Authority and the judicial organs. The Announcement does not introduce an entirely new legal regime for workplace camera use; it gathers under a single coherent text the principles previously addressed in scattered form in Board decisions, Council of State case law and doctrine.

In practice before the Announcement, camera use in workplaces was not categorically regarded as unlawful. The Board and the judicial organs accepted in principle the legitimacy of camera use for purposes such as ensuring workplace security, preventing occupational accidents, protecting company assets, assisting in the prevention and detection of crime and protecting critical production or storage areas. That acceptance was never interpreted, however, as an unlimited power of surveillance: the principles of proportionality, data minimisation and last resort were at the centre of practice in that period as well.

In its decision of 22 February 2024 (2024/1311 E., 2024/3381 K.), the 9th Civil Chamber of the Court of Cassation emphasised that the principles of lawfulness and good faith, processing for specified, explicit and legitimate purposes, and proportionality must be observed in the processing of personal data. Applied to camera systems, this approach shows that it is not sufficient for the employer to rely on a general security justification: the processing activity must be limited to a concrete and legitimate purpose.

“The fundamental question in data protection law is not 'may cameras be used?' but 'is it possible to achieve the same purpose by a less intrusive means?'”

In Council of State decisions the character of camera use as a measure of last resort comes to the fore. In the decisions of the 10th Chamber of 14 May 2018 (2015/2995 E., 2018/1736 K.) and 11 January 2021 (2019/10118 E., 2021/43 K.), it was stated that the installation of camera systems in such a way as to view employees' working areas may be accepted only as a last resort. Where the same purpose can be achieved by less intrusive methods, camera use may be regarded as disproportionate.

The practical consequence is considerable. If a card-access system is sufficient for entry and exit control, a camera system continuously recording employees' faces may be regarded as disproportionate. Similarly, if workflow reports or shift supervision suffice for monitoring production efficiency, a system continuously recording the entire production line in a manner that observes employee behaviour will create legal risk.

Areas of Monitoring

A distinction also emerged in the pre-Announcement period regarding the areas monitored. In the decision of the 10th Chamber of the Council of State of 11 January 2021 (2019/12558 E., 2021/42 K.), a more favourable approach was taken to camera use in areas such as building entrances and exits, corridors, car parks and external environments where security is a priority. By contrast, camera use in areas where the expectation of privacy is high — toilets, changing rooms, prayer rooms, showers and rest rooms — was accepted as unlawful.

The Board reached the same conclusion in its decisions of 4 August 2022 (2022/797) and 10 August 2023 (2023/1356). These decisions demonstrate that employees' private lives do not disappear entirely at the workplace and that in certain areas the expectation of privacy must be protected more intensively.

A more sensitive assessment is required in respect of working areas. In the decision of the Council of State Plenary Session of Administrative Law Chambers of 15 October 2020 (2020/1215 E., 2020/1870 K.), it was stated that positioning cameras so as to supervise continuously an employee's desk, performance or communications with others may give rise to problems in terms of the privacy of private life. This approach shows that what matters is not only where camera systems are physically located, but which area they view and in what manner.

Information Obligation, Audio Recording and Biometric Data

The information obligation is another significant heading. Under Article 10 of Law No. 6698, the data controller is obliged to inform employees, visitors and relevant persons that personal data is processed through camera systems. In its decision of 24 November 2022 (2022/1249), the Board stated that warning signs such as 'This workplace is monitored by camera 24/7 for your security' are one of the basic requirements of transparency. In the current approach, however, the display of a general sign alone is not considered sufficient: the data controller is expected to provide more comprehensive information regarding the purpose of recording, retention period, legal basis, data transfers and data subject rights.

The Board's approach to systems with audio recording is more restrictive still. In its decision of 12 March 2020 (2020/212), the Board assessed that where the intended benefit can be obtained through image recording, additional audio recording is contrary to the principle of proportionality and constitutes an interference with the privacy of private life by creating in individuals a continuing anxiety of surveillance. This approach forms the basis of the emphasis on audio recording in the Announcement.

A similar sensitivity applies to systems processing biometric data. In its decision of 1 December 2020 (2020/915), the Board stated that processing biometric data such as facial recognition or fingerprints for the purpose of attendance tracking may be regarded as disproportionate where less intrusive methods are available. This decision is of particular importance for camera systems with facial recognition features, smart entry-exit systems and AI-assisted employee tracking mechanisms.

Assessed together, the pre-Announcement decisions show that the Board and the judicial organs are not categorically opposed to camera use in workplaces, but expect such use to be conducted for concrete, legitimate and limited purposes such as security and occupational health, without interference in areas of privacy, avoiding more intrusive methods such as audio and biometric data, and without the system being transformed into an instrument of continuous performance supervision.

The New Approach Under the Announcement of 8 June 2026

The Authority's Announcement has rendered this pre-existing legal ground more visible and systematic. Its most important aspect is that the Authority gives a clear answer to the debate whether security cameras used in workplaces are a 'security instrument' or an 'employee surveillance instrument'.

The Authority accepts that camera use may be possible for purposes such as ensuring occupational health and safety, preventing occupational accidents, providing workplace security and assisting in the prevention and detection of crime. In this respect the Announcement is not a text prohibiting or entirely restricting workplace camera use. The Authority does, however, make clear that the use of camera systems outside the specified purpose and in a disproportionate manner may interfere with the right to privacy of private life and may lead to unlawful processing of personal data.

The strongest emphasis in the Announcement concerns the proposition that monitoring employees' performance, efficiency or discipline through camera systems cannot be assessed within the scope of a legitimate purpose. The Authority states that abstract purposes such as seeing whether employees are working efficiently, increasing discipline, providing general control or supervising employees cannot be accepted as legitimate for camera use.

“Even if the privacy notice states that the system is used for 'workplace security', if it is in fact used to monitor employee performance, this constitutes unlawful data processing.”

This is of considerable practical importance. In many workplaces camera systems are initially installed on security grounds but come, over time, to be used for monitoring employee behaviour, checking break times, tracking work discipline or conducting performance evaluations. The Announcement makes clear that such function creep gives rise to serious risk under the Personal Data Protection Law.

European practice weighs necessity and proportionality before technical adequacy.

Reasonable Expectation of Privacy and Technical Limits

Another important aspect of the Announcement is its strong emphasis on employees' reasonable expectation of privacy. The Authority accepts that presence at the workplace does not eliminate all of an employee's privacy expectations. The location of camera systems, their field of view, zoom features, continuity of recording and frequency of monitoring must therefore be determined having regard to employee privacy. This approach is of particular importance for open-plan offices, production lines, warehouse areas, canteens, break areas and social spaces. A camera positioned to secure entry and exit may be regarded as proportionate, whereas a camera positioned so as to monitor continuously employees' conduct at their desks or their communications with others may be regarded as disproportionate.

The Announcement also contains a specific warning regarding wide-angle and face-focused recording. The Authority states that as the scope and intensity of monitoring increase so does the gravity of the interference, and that wide-angle or face-focused recording covering all areas of the workplace should not be carried out. This demonstrates that the principle of data minimisation must be implemented at a technical level in camera systems.

In respect of systems with audio recording, the Announcement adopts a distinctly restrictive stance. Audio recording is assessed as an extremely intrusive method in terms of the privacy of private life. Cameras with audio recording capability should therefore not be used without the lawful justification and necessity for them being clearly established. In practice this may require the microphone functions of workplace camera systems to be checked and, if left enabled, disabled.

The Announcement also contains an important development regarding retention periods. The Authority states that retaining camera recordings for longer than necessary may constitute a breach of the Law and that the shortest possible period should be preferred; it further indicates that systems should incorporate an automatic destruction mechanism. This shows that technical infrastructure and legal compliance must be assessed together.

Finally, the Announcement emphasises that recordings must not be shared with unauthorised persons, that only authorised persons should be able to access recordings, that an authorisation matrix should be created, and that it should be determined who may access camera data and under what conditions. Not only the collection of camera recordings, but also their storage and the associated access processes, are subject to supervision under the Law.

The European Approach and Its Reflections in Turkish Law

The Authority's Announcement clearly reveals the gap between traditional practical habits regarding workplace camera use and current data protection standards. For many years camera systems were treated principally as a technical security investment; insufficient analysis was carried out of which areas the cameras viewed, how long recordings were retained, who accessed them, or what effect they produced upon employees.

The current approach under the Personal Data Protection Law, and the standards of European data protection law, require camera systems to be assessed not merely as a technical security instrument but as a personal data processing activity with high potential for interference.

  • Purpose and scope — facility security, general supervision, instantaneous performance control and attendance tracking carry risk; only security and occupational health are accepted, and discipline or performance surveillance is prohibited
  • Positioning — wide-angle and face-focused recording covering every area carries risk; the field of view must be limited to what the purpose requires
  • Audio — cameras with microphones enabled by default carry risk; audio recording requires separately demonstrated justification and necessity
  • Retention — indefinite or long retention carries risk; the shortest possible period and automatic destruction are expected
  • Access — unrestricted internal access carries risk; an authorisation matrix defining who may access what, and when, is expected
  • Transparency — a general warning sign alone carries risk; comprehensive information covering purpose, legal basis, retention, transfers and data subject rights is expected

Conclusion

The Announcement of 8 June 2026 should be read by data controllers not as an informative note but as a compliance instrument. Existing camera systems should be reviewed against purpose, field of view, audio capability, retention period, access authorisation and transparency; where the system has drifted, in practice, into employee monitoring, that drift should be documented, corrected and — where necessary — reflected in revised privacy notices and internal policies.

Related practice areaData Protection, Privacy & Cybersecurity→

Related reading

Data ProtectionThe Constitutional Court’s Viennalife Judgment: Publicly Disclosed Personal Data and the Principle of Legality16 June 2026Data ProtectionSharing Data With Third Parties and the Rules Governing Debt Payment Processes31 March 2026Data ProtectionCybersecurity Law No. 7545: Centralised Governance, Audit and Sanctions Regime24 March 2026