Security Cameras and KVKK: Signage, Retention and Access

Camera footage counts as personal data because it shows an identified or identifiable person. A business, complex management or apartment block installing a camera system must therefore follow the basic principles of Law No. 6698 (KVKK). This article is general information and does not replace legal advice.

1. Purpose and proportionality

Cameras must be used for a clearly defined legitimate purpose: security, theft prevention, protection of life and property. Continuously monitoring staff productivity, or watching changing rooms, toilets and rest areas, breaches the proportionality principle.

2. Duty to inform

Before people enter the camera area, a visible sign must state that CCTV monitoring takes place, who the data controller is and the purpose. The sign is the first layer; the detailed notice can be on the website or at the reception desk.

3. Retention period

Footage must be kept for as long as the purpose requires and then deleted or anonymised. In practice around 30 days is considered reasonable for many businesses, but the period must be justified and documented for each business.

4. Access rights and logs

Only authorised persons should access footage. Who viewed which recording and when should be logged. The room housing the recorder must be locked and remote access should use strong passwords and multi-factor authentication.

5. Transfer to third parties

Footage may be shared only on legal grounds such as a request from law enforcement or a court. Publishing a recording on social media can have serious consequences.

6. Complexes and apartment blocks

The same principles apply to common-area cameras; in addition, owners' decision-making must follow the Condominium Law. Camera angles that capture residential entrances or a neighbour's balcony can cause problems.

The Teyakkuz approach

At installation a sign template, privacy notice, role-based user permissions and access logs come ready. That way your camera increases security without increasing legal risk.

A short checklist

Before installing cameras, answer these questions: What is my purpose and can I document it? Which areas am I monitoring and is that proportionate? Are the sign and notice ready? How long will recordings be kept and how will deletion work? Who can access them and are accesses logged? A business with written answers to these questions is far more comfortable in a possible inspection or complaint.

For small businesses these obligations can look heavy, but a template notice, a proper sign and role-based permissions are often enough as a start. Identifying the gaps and prioritising them reduces anxiety about inspections.