The Turkish Personal Data Protection Board's Decision on the Tourism and Hotel Management Sector has been published

The Personal Data Protection Board ("Board")'s "Board Decision on the Recording of Photocopies of Turkish Republic Identity Documents of Persons Receiving Accommodation Services in the Tourism and Hotel Sector," issued in Law No. 2025/2120 and dated November 6, 2025, was published in the Official Gazette No. 33102, dated December 9, 2025.

Generally, in the Turkish tourism and hotel sector, copies of ID cards are taken in addition to their identification information when welcoming the guests and their personal data is processed. Due to numerous complaints received by the Board, the Board investigated the requirement to obtain copies of IDs and issued a Board Decision on this matter.

The Board stated that, under various laws in the tourism and hotel sector, copies of ID cards taken in addition to identification and comparison of the given data will result in excessive data processing and have no legal basis for this activity.

On the other hand, the Board emphasized that the use of old ID cards alongside the new chip-enabled ID cards, and that because the old ID cards contained sensitive personal data such as blood type and religion, the processing of this data violated Article 6 of Law No. 6698 on the Protection of Personal Data.

The Board determined that, under Tax Procedure Law No. 213, information such as name, surname, address, tax office, and tax account number (if applicable) may be processed, and that this processing activity meets the requirement that it be explicitly provided for in the laws stipulated in Article 5(1)(a) of Law No. 6698 on the Protection of Personal Data.

The decision determined that photocopies of ID cards obtained before the date of the Board Decision should be destroyed in accordance with Article 7 of Law No. 6698, and that the practice of making ID card copies should be suspended.

You can access the relevant Principle Decision here.