This content has been translated from the original text.
For many years, taking photocopies of guests' identity documents during check-in at accommodation facilities was seen in the sector as a "routine" and "mandatory" procedure, applied almost without question. This practice was most often defended on grounds of security, compliance with legislation or administrative convenience, and was not sufficiently discussed from the standpoint of personal data protection law. However, with growing awareness of personal data protection and the legal limits of data processing activities being drawn more clearly, the lawfulness of these established practices has also come to be re-evaluated. Indeed, the Principle Decision issued by the Personal Data Protection Board and entered into force through the Official Gazette has expressly established that taking a photocopy of an identity document from persons receiving accommodation services in the tourism and hospitality sector at check-in is an unlawful data processing activity under the Personal Data Protection Law No. 6698. In this article, we will address the Principle Decision in question, its purpose, its legal bases, and which data accommodation facilities may process and to what extent.
For many years, taking photocopies of guests' identity documents during check-in at accommodation facilities was seen in the sector as a "routine" and "mandatory" procedure, applied almost without question. This practice was most often defended on grounds of security, compliance with legislation or administrative convenience, and was not sufficiently discussed from the standpoint of personal data protection law. However, with growing awareness of personal data protection and the legal limits of data processing activities being drawn more clearly, the lawfulness of these established practices has also come to be re-evaluated. Indeed, the Principle Decision issued by the Personal Data Protection Board and entered into force through the Official Gazette has expressly established that taking a photocopy of an identity document from persons receiving accommodation services in the tourism and hospitality sector at check-in is an unlawful data processing activity under the Personal Data Protection Law No. 6698. In this article, we will address the Principle Decision in question, its purpose, its legal bases, and which data accommodation facilities may process and to what extent.
The Legal Background of the Practice of Taking Identity Photocopies in Accommodation Facilities
For accommodation facilities operating in the tourism and hospitality sector, the obligation to collect guests' identity details and to notify the competent law enforcement units rests on various legislative provisions that have long been in force. In particular, under the Law No. 1774 on Notification of Identity (Kimlik Bildirme Kanunu), accommodation facilities have been required to establish the identity details of their customers and transmit them to the relevant systems; in practice, this obligation has most often been interpreted as taking a photocopy of the identity document. However, this interpretation has become a practice that does not coincide with the wording and purpose of the legislation, that has become entrenched over time, but whose legal basis has not been sufficiently questioned.
In practice, accommodation facilities have most often defended taking identity photocopies on grounds such as security, avoiding problems during inspections or providing administrative convenience, and have proceeded on the assumption that the legal basis of this procedure lies in the Law on Notification of Identity or in the related secondary regulations. However, when the legislative provisions in question are examined, it can be seen that the obligation imposed on accommodation facilities is limited to "presentation of the identity document and recording of the identity details", and that no clear and explicit requirement is laid down to make an exact copy of the identity document, or to scan or retain it. Despite this, the practice of taking identity photocopies was adopted in the sector almost as a standard procedure and continued for many years.
With the development of personal data protection law, however, the legal nature of this practice has become more visible. This is because a photocopy of an identity document contains not only basic information such as name and identity number, but also a photograph, date of birth, serial number and many other items of personal data on a single document, and in this respect it gives rise to serious risks in terms of the principles of data minimisation and proportionality. The question whether it is necessary to process such a wide-ranging data set in order to provide the accommodation service and to fulfil the relevant notification obligations has become one of the fundamental issues to be discussed within the framework of personal data protection law.
It is precisely at this point that, with the Principle Decision of the Personal Data Protection Board, it has been expressly established that there is no legal basis for the practice of taking identity photocopies in accommodation facilities and that this practice is incompatible with the fundamental principles of personal data protection; for the first time, the legal limits of an established practice that has long continued across the sector have been drawn so clearly.
The Personal Data Protection Board's Principle Decision and Its Legal Grounds
The practice of taking photocopies of Turkish Republic (T.C.) identity documents from guests during check-in at accommodation facilities operating in the tourism and hospitality sector was evaluated by the Personal Data Protection Board on the basis of applications received and ex officio examinations, and as a result of this evaluation Principle Decision No. 2025/2120 dated 06.11.2025 was adopted. The Principle Decision in question entered into force upon its publication in the Official Gazette No. 32361 dated 09.12.2025. With the decision, the legal basis of the practice of taking identity photocopies, which had long continued in the sector and had in fact become a standard procedure, was expressly discussed, and this practice was found to be contrary to the Personal Data Protection Law No. 6698.
In the Principle Decision, the Board first relied on Article 5 of the KVKK, which regulates the conditions under which data controllers may process personal data, and examined whether accommodation facilities' practice of taking identity photocopies rests on any of the legal grounds that permit data processing without explicit consent. In the assessment made in this context, it was established that the obligation imposed on accommodation facilities under the Law No. 1774 on Notification of Identity is limited solely to establishing and notifying identity details, and that there is no express provision in the legislation providing for taking a photocopy of the identity document. Accordingly, it was expressly stated that taking identity photocopies does not satisfy the requirement of being "expressly provided for in laws". In the Principle Decision, the Board also attached particular importance to the general principles regulated in the relevant article of the KVKK, and assessed that the principle that personal data must be relevant, limited and proportionate to the purposes for which they are processed has been violated by the practice of taking identity photocopies. This is because a photocopy of an identity document contains not only basic information such as first name, surname and identity number, but also a photograph, date of birth, serial number and many other items of personal data, and the Board has expressly set out that such a wide-ranging data set is not necessary for the provision of accommodation services.
Another point drawn attention to in the Principle Decision is that the data processing activity carried out by taking identity photocopies also increases data security risks. According to the Board, storing identity photocopies in physical or digital media brings with it the risks of unauthorised access, data breaches and misuse, and it is clear that these risks can be significantly reduced if the principle of data minimisation is complied with. In this framework, the Board once again emphasised that data controllers must content themselves with the data necessary for the purpose of processing.
In the Principle Decision, the Board expressly stated that this regulation is not merely a prohibition for the future; identity photocopies obtained without a legal basis before the publication of the decision must also be deleted, destroyed or anonymised within the framework of Article 7 of the KVKK and the relevant destruction legislation. In this respect, the Principle Decision is a binding regulation that requires accommodation facilities to review their existing data retention policies and to take the necessary compliance steps without delay.
If accommodation facilities continue the practice of taking identity photocopies despite this Principle Decision, the businesses concerned may face violations of the data security obligations under Article 12 of Law No. 6698 and data processing acts in breach of Articles 4 and 5 of the Law. In this context, as a result of examinations to be carried out by the Personal Data Protection Board ex officio or upon complaint, the administrative fines provided for in Article 18 of the KVKK may be imposed on data controllers, a decision may be made to delete or destroy personal data processed unlawfully, and, depending on the nature of the violation, an obligation to notify a data breach may arise.
Conclusion
With Principle Decision No. 2025/2120 dated 06.11.2025 of the Personal Data Protection Board, it has been established in a clear and unequivocal manner that the practice of taking identity photocopies, which has been widely applied for many years in the tourism and hospitality sector and which has most often been assumed to derive from legislation, is unlawful under the Personal Data Protection Law No. 6698. With this decision, while it remains possible for accommodation facilities to request presentation of the identity document during check-in procedures and to record the identity details to the extent required by the legislation, it has become clear that data processing activities carried out by taking, scanning or retaining a photocopy of the identity document are no longer legally acceptable.
The Principle Decision once again shows that the legal basis of practices that have become entrenched in a sector does not always exist, and that in personal data protection law the justification of "habit" or "industry practice" does not, on its own, provide sufficient legitimacy. In this framework, accommodation facilities need to review not only their forward-looking practices but also their data retention and destruction processes relating to identity photocopies obtained in the past without any legal basis, and bring them into compliance with the KVKK.
In conclusion, with the Principle Decision in question, the limits on the processing of personal data have become more distinct for data controllers operating in the tourism sector, and the legal difference between checking an identity document and reproducing it has been clearly drawn. If accommodation facilities fail to update their internal procedures in light of this new legal framework, they will inevitably face administrative sanctions and other legal liabilities.
Av. Mehmet Emre Darıcı
