Law note · Turkey
Personal Data Protection Law (KVKK), special categories and biometric data
What it requires
- An app that captures or processes biometric data, including a voiceprint or faceprint, from a person in Turkey must treat it as special-category data under KVKK Art. 6 and obtain explicit consent or rely on one of Art. 6(3)'s other statutory grounds before processing, even though the Act does not itself define what counts as biometric data.
When LexLint raises it
processes_biometricsprocesses_voicetrains_modelscrawls_web
What we found
Art. 6(1) lists biometric and genetic data, alongside race, ethnic origin, political opinion, philosophical belief, religion, health, sexual life, criminal convictions, and trade-union or association membership, as special-category data.
Processing requires one of the Art. 6(3) grounds added by the 2024 amendment: explicit consent, a legal provision, vital-interest necessity, the subject's own publication of the data consistent with the subject's intention to make it public, rights establishment, public health necessity, employment or social security law, or a closed list of nonprofit-association member data; the pre-2024 text instead required near-universal explicit consent.
KVKK gives no statutory definition of biometric data, voiceprint, or faceprint anywhere in the Act, so the term must be read inclusively: a voiceprint or faceprint captured for identification falls within the undefined biometric data category and triggers this special-category regime, even though no provision names either modality or sets a biometric-specific retention rule.