Cameras and KVKK: information signs, retention and access

Why does a camera recording count as personal data?

Personal data is any information about an identified or identifiable person. A camera facing the shop's register records the customer's face, clothing and what time they came. If a person can be recognized from this recording, then under the law you are processing personal data.

The business that installs the camera and keeps the recording is the data controller, as the law calls it. The company that did the installation or the service provider that keeps the recording in the cloud does not take on this responsibility. Putting up the notice, setting the retention period and deciding who looks at the recording are the business's job.

In housing estates and apartment buildings, the data controller is often the management. If a resident installed a camera at their own door and it sees the shared corridor, that resident is responsible for this recording and is likely to have problems with neighbors. Installing a common-area camera by a management decision and putting the decision in the minutes reduces later disputes.

What goes on the privacy notice sign?

The law requires the data controller to inform people when collecting data. For cameras, the most practical way is a sign seen before entering the camera area. The sign can be short; you put the detailed text on your website, at the entrance or at the register, and the sign says where to find this text.

Writing "This area is monitored by camera" on the sign alone may not count as informing people. The reader must be able to find answers to these questions:

• Who is recording: the business's legal name and contact details
• For what purpose: a clear purpose such as security or preventing theft
• Who the recording may be shared with: for example, authorized public bodies if requested
• The person's rights and how to apply: such as asking for information about their recording
• Where the detailed privacy notice can be found

Expert note: Put the sign at eye level and before the camera. A sign placed behind a door or under the camera gets read after the person is already in the recording.

Where should cameras not be placed?

If the purpose is security, the camera should look at areas that serve security: entrance, register, storeroom door, parking lot. Placing cameras where privacy is highest, such as toilets, changing rooms and nursing rooms, cannot be defended. For areas like a rest room or a tea kitchen, too, do not place a camera if you cannot clearly justify your purpose.

An angle that sees inside the neighboring shop, the window of the building across the street, or the whole street also causes problems. At installation, ask that the camera see only your own area. Most recorders have a masking feature that blacks out part of the image; you can cover areas such as windows with it.

Audio recording is a separate matter. If video is enough, keep the microphone off; if you want to capture sound, assess this beforehand with legal support.

How long should recordings be kept?

The law does not give a number of days for cameras. The general principle is to keep data for as long as the purpose for which it is processed requires. In a store, a theft or an argument is usually noticed within a few days; that is why businesses set a reasonable period and configure the recorder to delete the old footage when this period is up.

Put the period you choose into a written retention and disposal policy and keep it consistent with the device setting. The only reason for extending the period should not be disk capacity . If an incident has happened, exporting the relevant footage separately and keeping it with the incident file is a better way than keeping the whole device full for months.

When choosing the retention period, ask yourself this question: what is the latest I would notice an incident? A shop that is closed on weekends should be able to see Saturday night's recording when it opens on Monday morning. A warehouse that does a stock count once a week should be able to reach that week's recording when it finds a count discrepancy. If you set the period according to this workflow, you have neither kept more data than necessary nor been left without a recording when you needed it.

Who can access the recording?

Restricting access is both one of the technical measures the law expects and, in practice, the most often neglected matter. There are quite a few businesses where everyone uses the "admin" account on the recorder and the password is stuck on top of the device.

Open a separate account for each user. If the cashier needs to watch the live view, give them only viewing permission; leave the permission to delete and export recordings with the business owner or a manager. If viewing from a phone is turned on, change the app password when an employee leaves.

If the police or the prosecutor's office asks for footage for an incident, take the request in writing, hand over only the relevant time range, and put this on record.

A recorder being open to the outside over the network is also an access issue. Setting up remote viewing by opening random ports on the modem can leave the device exposed to scans on the internet. If you need remote viewing, prefer the manufacturer's secure cloud connection or a method such as a VPN, and keep the device software up to date.

Is VERBİS registration required?

VERBİS is the Personal Data Protection Authority's registry of data controllers. The registration obligation varies with the size and field of activity of the business, and the Board may update these criteria over time. A small tradesperson may not be required to register; a hospital or a large company most likely is.

Even if you have no registration obligation, the obligations of notification, retention and security continue. Do not confuse these two matters.

Expert note: This article gives general information and is not legal advice. Consult your organization's legal department or an expert who works on KVKK about your business's situation, your VERBİS obligation and your privacy notice.

What should you ask for at the installation stage?

Part of KVKK compliance is solved at installation. Show the company on a plan which areas the cameras will see, ask for masking of neighboring areas, have the recorder's retention period set to the value you decide, and have user accounts opened according to permissions. At handover, check that the default password has been changed.

In Desa Bilişim installations, the sign location, masking and user permissions are on the handover list. We recommend that the business prepares the content of the legal text with its own adviser.

Frequently asked