THE PERSONAL DATA PROTECTION BOARD'S "PRINCIPLE DECISION ON RECORDING COPIES OF TURKISH ID CARDS OF PERSONS RECEIVING ACCOMMODATION SERVICES IN THE TOURISM AND HOSPITALITY SECTOR" PUBLISHED IN THE OFFICIAL GAZETTE

The Personal Data Protection Board's principle decision dated November 6, 2025, regarding the recording of photocopies of Turkish ID cards of persons receiving accommodation services in the tourism and hospitality sector was published in the Official Gazette No. 33102 on December 9, 2025.

In this decision, which is extremely important for those providing and receiving services in the tourism sector: The Board found that recording identity information for reporting to law enforcement agencies in accordance with the Identity Reporting Law No. 1774 was lawful, but considered taking a photocopy or scanning of the identity document to be excessive data processing.

• In this Principle Decision, the Board:
• Law No. 1774 and the relevant Regulation stipulate that the necessary information (name, surname, Turkish ID number) must be recorded in the register, and therefore the processing of this information is based on the grounds of "being explicitly stipulated in the laws" and "legal obligation." However, it does not contain a provision regarding the storage of a copy of the identity document. Therefore, obtaining a photocopy/scan of the identity document is considered "excessive" data processing, and since there is no "legal processing condition" for the processing activity in question, the process is unlawful.
• He emphasized that photocopying the "religion" and "blood type" information contained in old-style identity cards constitutes a violation of Article 6 of the Law regarding special categories of personal data,
• It emphasized that viewing the document is sufficient for identity verification and that taking a copy constitutes excessive data processing.

 

• The decisions taken by the Board within the scope of the conclusions reached in the Principle Decision are as follows:
• The practice of obtaining photocopies/scans of visitors' IDs must be discontinued immediately.
• Photocopies of identity documents obtained and archived to date must be destroyed immediately in accordance with Article 7 of the Law.
• It is stated that the public and industry representatives will be informed that if data controllers fail to act in accordance with this Principle Decision, the provisions of Article 18 of the KVKK titled "Offenses" will be applied.

As a result, previous publications of the KVKK stated that taking photocopies of IDs in hotels could only be in line with the data minimization principle if sensitive parts such as religious information and blood type were blacked out. However, following numerous complaints, the Board reassessed the processes and ruled that taking photocopies of IDs, even if blacked out, is contrary to the data minimization principle. Considering that administrative fines, which can be applied with the 2026 revaluation rates, may reach up to 17.092.242 TL, tourism and hotel businesses must urgently review their practices of taking photocopies of identity documents and, if photocopies have been taken in the past, immediately carry out the destruction process.

You can access the Official Gazette announcement of the Principle Decision here.