Personal Data Protection Authority’s Principle Decision on the Recording of Turkish ID Card Photocopies in the Tourism and Hospitality Sector
The Personal Data Protection Authority (“Authority”) published its Principle Decision regarding the recording of photocopies of Turkish ID cards belonging to individuals receiving accommodation services in the tourism and hospitality sector on 09.12.2025 on its official website and in the Official Gazette dated 09.12.2025 and numbered 33102.
Due to the nature of the services provided, the tourism and hospitality sectors are among the industries in which personal data is processed most extensively. Following complaints and notices submitted to the Authority regarding the practice of collecting photocopies of Turkish ID cards from guests at accommodation facilities, the Authority conducted an assessment within the scope of the Law No. 6698 on the Protection of Personal Data (“KVKK”). As a result of its evaluation, the Authority determined that obtaining identification information consisting of name, surname, and Turkish ID number for the purpose of verifying the identity of the individual presenting the document is compliant with the legislation under the Identity Reporting Law No. 1774. However, taking and storing photocopies of such identification documents constitutes excessive data processing and lacks a legal basis.
As a result of this assessment, the Authority resolved that:
Data controllers operating in the tourism and hospitality sector must cease the practice of collecting photocopies of Turkish ID cards from individuals accommodated at their premises, and
Data controllers who, prior to publication of the Authority’s Principle Decision, recorded photocopies of Turkish ID cards belonging to individuals staying for accommodation purposes must destroy such documents in accordance with Article 7 of the KVKK.
The Authority emphasized that the Principle Decisions once published in the Official Gazette and on the Authority’s website, are binding in practice for all sectors. In the event of non-compliance, the Authority has the power to impose administrative sanctions pursuant to Article 18 of the KVKK.
Successful