In short
The employer is the data controller for leave data. Because leave calculation and leave requests rest on performing the employment contract and on legal obligations, employees should not be asked for explicit consent; give them a privacy notice and record only that they have read it (Board decision 2022/797, Principle Decision 2026/347). For special category data such as sick notes, the adequate measures set by the Board, including at least two-factor authentication for remote access, are mandatory (KVKK Art. 6/4, Board decision 2018/10). Employees' KVKK requests must be answered free of charge within 30 days at the latest (Art. 13/2).
Key points
- The employer is the data controller; the leave software provider processes data on its behalf as data processor (KVKK Art. 3).
- Leave data needs a privacy notice, not explicit consent; employees only confirm “I have read and understood it”.
- Health data is special category data: do not store diagnoses, limit access and use two-factor authentication (Board decision 2018/10).
- Employee requests are answered within 30 days at the latest, free of charge, in writing or electronically, with reasons for any refusal (Art. 13/2).
- The data controller notifies the Board of a breach within 72 hours at the latest of learning of it (Board decision 2019/10).
Leave data includes identity, pay, leave details and sometimes sick notes. This guide summarises the main obligations under the Personal Data Protection Law No. 6698 (KVKK) and the decisions of the Personal Data Protection Board (the Board).
Who is the data controller and who is the data processor?
Under KVKK, the data controller determines the purposes and means of processing (Art. 3/1-ı); the data processor processes data on the controller's behalf, based on the authority the controller grants (Art. 3/1-ğ).
- The employer is the data controller. Your company decides why and how employees' leave, identity, pay and sick-note data is processed.
- The leave software provider is the data processor. The Authority's guidance gives cloud service providers as an example. Purposes, data types, recipients and retention periods remain the controller's decisions.
The controller is responsible, together with the processor acting on its behalf, for data security measures (Art. 12/2), and confidentiality continues after the engagement ends (Art. 12/4).
What legal bases cover leave data?
| Data | Example | Legal basis |
|---|---|---|
| Leave requests, approvals, balance movements | Annual leave request, approval history | Performance of the contract (Art. 5/2-c), legal obligation (Art. 5/2-ç) |
| Leave record and personnel file | Annual leave record form | Legal obligation (Art. 5/2-ç; Labour Law Art. 75, Annual Paid Leave Regulation Art. 20) |
| Records kept as evidence in disputes | Proof of leave granted | Establishing, exercising or protecting a right (Art. 5/2-e) |
| Health data | Sick note dates and type | Legal obligations in employment and social security (Art. 6/3-f), where needed Art. 6/3-d |
Art. 6/3-(f) applies only where processing is necessary for that obligation and respects the Art. 4 principles, including proportionality.
A privacy notice, not explicit consent
In decision 2022/797, the Board called basing on explicit consent any processing that can rest on another legal basis "misleading and an abuse of right"; its examples expressly include leave calculation and leave requests. Principle Decision 2026/347 (Official Gazette 24.03.2026) requires that, where another processing condition applies, no separate consent text is presented and only feedback that the notice has been read is collected. Phrases like "I have read and accept" or "I approve" are therefore inappropriate.
Consent that an employee cannot realistically refuse is not freely given (Board decision 2020/404), and under Principle Decision 2026/2035 employee consent cannot, as a rule, be the primary legal basis.
A privacy notice must at least name the controller and state the purposes, to whom and why data may be transferred, the collection method and legal basis, and the employee's Art. 11 rights (Communiqué on the Obligation to Inform, Art. 4); the controller must prove it was given (Communiqué Art. 5).
Health data: special category data
Health data is special category personal data (Art. 6/1). In leave processes this covers sick notes, reports for a disabled or chronically ill child, and pregnancy and birth details. Processing it requires the adequate measures set by the Board in decision 2018/10 (Art. 6/4):
| Measure (Board decision 2018/10) | In leave processes |
|---|---|
| Policy, training, confidentiality agreements | Written rules for HR staff who access health data |
| Defined access rights, periodic review | Only roles that need them see health documents |
| Cryptographic storage, keys kept separately | Sick-note attachments stored encrypted |
| At least two-factor authentication for remote access | Two-factor authentication for users who open health documents |
| Encrypted email or KEP for transfers | No sick notes as plain email attachments |
Do not store diagnoses. Leave needs only the dates and type of the sick note. No published Board decision dealing specifically with diagnoses was found, but proportionality (Art. 4/2-ç) and the Board's decisions on workplace health records (e.g. 2020/769, 2022/172) support keeping diagnoses out of the HR system.
Do not show the leave type to everyone. The Board has stated that the employment contract is not a valid basis for sharing employees' leave status with others in their unit (2023/646); it is safer to show colleagues only that someone is on leave.
Retention and destruction
The law sets no specific retention period for leave records; limitation periods and the need for evidence determine it.
| Data | Basis | Guideline |
|---|---|---|
| Leave records, requests, approvals, balance movements | No period in the Annual Paid Leave Regulation (Art. 20); the limitation period for annual leave pay is 5 years and starts when the contract ends (Labour Law Add. Art. 3, Art. 59) | At least 5 years after employment ends; 10 years as a prudent choice |
| Documents for days not worked (sick notes, unpaid leave requests) | Law No. 5510, Art. 86/2 | 10 years from the start of the year following the year concerned |
| Personnel file | Labour Law Art. 75 (no period) | Suggested: employment + 10 years |
| Destruction records | Deletion Regulation Art. 7/3 | At least 3 years |
The 10-year figure is a prudent choice (Code of Obligations Art. 146, Law No. 5510 Art. 86); the Board has set no general period for personnel files.
When the period ends, the Deletion Regulation applies: data is deleted, destroyed or anonymised so that it cannot be linked to anyone, even with other data (Art. 10/1); destruction runs at least every six months (Art. 11/2); and an employee's deletion request is concluded within 30 days, or refused with reasons if a processing condition still applies (Art. 12).
Employee requests (KVKK Art. 11)
Employees can apply to the employer to exercise their Art. 11 rights, such as information, access, correction and deletion.
- Deadline and fees: a request is concluded free of charge within 30 days at the latest (Art. 13/2); up to ten pages is free, and above that a fee of 1 lira per page may be charged (Application Communiqué Art. 7).
- Response: given in writing or electronically, with reasons for any refusal; oral communication does not count as a response (Authority announcement, 01.10.2026).
- Complaint: the employee may complain to the Board within 30 days of learning the response, and at most 60 days after the request (Art. 14/1).
A processor forwards any request it receives to the controller without delay.
If a data breach happens
Under Board decision 2019/10, the controller notifies the Board without delay and within 72 hours at the latest of learning of a breach, and notifies those affected as soon as reasonably possible. A processor notifies the controller of a breach on its side without any delay. Breaches and the measures taken are recorded, and a breach response plan is kept under review.
VERBİS and cross-border transfers
VERBİS: under Board decision 2025/1572, controllers with fewer than 50 employees a year and a balance sheet total below 100 million lira are exempt if their main activity is not processing special category data (if it is, the thresholds are 10 employees and 10 million lira). Others register within 30 days of becoming subject to the obligation; data processors do not register.
Cross-border transfers: storing data on a server abroad, or making it accessible from abroad, is a transfer. With no adequacy decision for any country, a transfer needs an Art. 9 safeguard such as the Board's standard contract, used unchanged and notified to the Authority within five working days of signature (Art. 9/5). Continuous hosting is not occasional, so explicit consent cannot be relied on. Ask your provider where data is kept and which safeguard applies.
How İzin360 handles it
İzin360 is your data processor for this data (see privacy and security):
- Privacy notice and read receipts. Draft your employee privacy notice from a template, edit and publish it; each new version asks employees to confirm "I have read and understood it", which is not consent. No explicit consent is requested when employees are invited.
- KVKK requests. Employees submit requests in the app and they reach your company; HR's inbox shows the 30-day deadline, responses are written and refusals need a reason.
- Data export. Employees can download their own data as a ZIP file; HR can download an employee's data to answer an access request.
- Retention and anonymisation. Former employees' personal data is anonymised automatically after the period you choose (5–30 years after employment ends, 10 by default), and each action is logged; a legal hold stops this for a lawsuit or audit.
- Health documents. Uploads are virus-scanned and stored encrypted. Opening another employee's health document requires two-factor authentication. In the team calendar, colleagues see health-related leave only as "On leave"; only HR, the employee and their manager see the type. National ID number, salary and date of birth are encrypted.
- Breach notices. İzin360 delivers data breach notices to your company in the app; you record that you have received them and see the 72-hour window for notifying the Board.
See the security page for all measures.
Frequently asked questions
Do I need employees' explicit consent to process leave data?
No. Leave calculation and leave requests rest on performing the employment contract and on legal obligations. The Board has found it misleading to base these on explicit consent (2022/797), and Principle Decision 2026/347 requires that no consent text be presented in this case. Give a privacy notice and record only that it has been read.
Can colleagues see who is on sick leave?
The leave type can reveal health or family circumstances. In decision 2023/646, the Board stated that the employment contract is not a valid basis for sharing employees' leave status with others in their unit. It is safer to show colleagues only that someone is on leave and limit the type to HR and the manager.
How long should I keep a former employee's leave records?
The law sets no specific period. The limitation period for annual leave pay is 5 years and starts when the contract ends (Labour Law Add. Art. 3, Art. 59). Keeping records for at least 5 years after employment ends, and 10 years as a prudent choice, is therefore advisable. Documents for days not worked are kept for 10 years under Law No. 5510, Art. 86/2.
How quickly must I answer an employee's KVKK request?
Within 30 days at the latest and free of charge (Art. 13/2). The response must be in writing or electronic, with reasons for any refusal. For responses over ten pages, a processing fee of 1 lira may be charged for each additional page.
Does our company have to register with VERBİS?
Data controllers with fewer than 50 employees a year and an annual balance sheet total below 100 million lira, whose main activity is not processing special category data, are exempt (Board decision 2025/1572). If you exceed either threshold, you must register within 30 days.
Legal basis
- Personal Data Protection Law No. 6698 (KVKK), Art. 3, 4, 5, 6, 9, 11, 12, 13, 14 and 16
- Personal Data Protection Board decision 2018/10 (adequate measures for special category data)
- Board decision 2019/10 (data breach notification)
- Board decision 2022/797 and Principle Decision 2026/347 (explicit consent and the obligation to inform)
- Board decision 2020/404 and Principle Decision 2026/2035 (employee consent)
- Board decision 2023/646 (sharing leave status with other employees)
- Board decision 2025/1572 (VERBİS registration exemption)
- Communiqué on the Obligation to Inform (Official Gazette 10.03.2018)
- Communiqué on the Procedures and Principles of Applications to the Data Controller (Official Gazette 10.03.2018)
- Regulation on the Deletion, Destruction or Anonymisation of Personal Data
- Labour Law No. 4857, Art. 59, Art. 75 and Additional Art. 3; Law No. 5510, Art. 86