Store camera recording and data protection: retention, notice and camera analytics

What purposes make store camera recording legitimate?

The Authority's announcement opens with a finding: recording images in a workplace with a security camera is plainly a personal data processing activity. Every camera therefore needs one of the legal grounds listed in Article 5 of Law No. 6698 and must comply with the principles in Article 4: lawfulness and fairness; specified, explicit and legitimate purposes; being relevant, limited and proportionate to those purposes; and being kept only for as long as necessary.

The announcement accepts that an employer may use cameras in the workplace because of the obligations arising from Article 417 of the Turkish Code of Obligations and Article 4 of the Occupational Health and Safety Law. It nevertheless requires the purpose to be fixed in advance for each specific case, and gives as examples providing workplace security, helping to prevent and detect crime, and protecting the occupational health and safety of employees.

The same announcement is equally explicit about purposes that are not legitimate. Abstract aims such as seeing with a camera whether employees are working productively, improving discipline or exercising general control do not count as legitimate purposes; a camera must not be used outside its stated purpose to monitor attendance or performance. The Authority also restates data minimisation, that is reducing the data processed to the least needed to reach the purpose, and the three elements of proportionality: suitability, necessity and proportionality in the narrow sense.

This guide is general information and does not replace legal advice. The legal ground, privacy notice and retention period for your own installation should be assessed with a lawyer working in data protection.

Where a camera may and may not go in a store

The announcement ties placement to proportionality. In common areas such as entrances, exits and stockrooms, or in areas carrying a security risk such as the till, a camera may look proportionate provided its position and field of view are considered. Cameras must not be placed in private areas such as toilets, changing rooms, prayer rooms and rest areas.

After placement comes how the camera sees. Field of view, zoom, whether recording is continuous and how often it is watched are each assessed separately; even at work, employees have a reasonable expectation of privacy. The announcement notes that the wider the monitoring, the heavier the interference, and asks that recording not be wide-angle across every area of the workplace or focused on faces. In the sales floor where customers move around, the possibility that people needing special protection, such as children, are also affected is weighed as well.

Board decision 2022/797 of 4 August 2022 shows how that limit is applied in practice. The Board held that employees have a reasonable expectation of privacy in changing rooms, toilets, showers, prayer rooms, rest rooms and nursing rooms. Although it was argued that the camera in the toilet corridor was a deterrent camera that took no recordings, the Board considered that giving employees the feeling of being watched at all times was contrary to the rule of fairness, and instructed that the position of every camera be reviewed.

How to prepare the camera warning sign and the privacy notice

The announcement asks that employees be informed about the camera and that the obligation to inform under Article 10 of the Law, namely that the area is being recorded, be met. Article 10 lists the five elements of a privacy notice: the identity of the data controller, the purposes for which data will be processed, to whom and for what purpose it may be transferred, the method and legal ground of collection, and the rights of the data subject under Article 11.

The Authority's Guide on Meeting the Obligation to Inform (March 2025) gives layered notice as the example for cameras. The first layer is the sign in the place where the camera is: the identity of the data controller, a short statement of purpose (in the guide's example, monitoring and recording by camera 24 hours a day, seven days a week for the purpose of providing security) and how to reach the detailed text. The second layer is the detailed privacy notice carrying every element in Article 10. Among the written methods the guide lists a sign hung on the wall at the building entrance and an information board mounted under the camera.

Article 5 of the Communiqué on the obligation to inform also governs how the text is written: the purpose must be specified, explicit and legitimate; general and vague wording, and sentences that give the impression that the data may later be used for other purposes as well, are to be avoided; the language must be plain and understandable. Where processing rests on explicit consent, the notice and the consent are handled separately.

In the case behind Board decision 2023/2007 of 30 November 2023, the data controller reported that it had put privacy notices at the facility entrances and warning signs marked with a camera symbol on a yellow background where the cameras were, and that it had prepared separate notices for groups such as employees, job applicants and suppliers. The same distinction applies in a grocery chain: the customer is informed by the sign, the employee additionally by the notice given to them.

The wording in the table is adapted from the security camera notice example in the Authority's guide. The legal ground is determined separately in every business; copying the example as it stands is not enough.

How long is camera footage kept?

Neither the Law nor the Authority's announcement sets a fixed period in days for camera footage. Article 4 of the Law requires personal data to be kept for the period set out in the relevant legislation or for as long as the purpose of processing requires. The announcement makes that concrete for cameras: because keeping footage longer than needed may breach the Law, the shortest possible period should be treated as sufficient and the system should have an automatic destruction mechanism. If an incident occurs, only the footage relating to that incident is kept for the duration of the legal process.

The period itself is the business's own decision and it must be written down. Under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data, data controllers required to register with the Data Controllers' Registry prepare a personal data retention and destruction policy; the policy includes a table showing retention and destruction periods and the periodic destruction intervals. The periodic destruction interval may not exceed six months. Those six months are not the retention period of the footage; they are the maximum interval at which data whose period has expired must be destroyed. A data controller with no policy obligation destroys the data within three months of the destruction obligation arising. Destruction operations are recorded and those records are kept for at least three years.

In practice, automatic destruction usually happens by the recorder overwriting older footage. That method also appears in the defences reflected in Board decisions: in the workplace behind decision 2022/797 it was stated that the cameras deleted and overwrote older footage and that the devices held at most one month of recordings. That is a data controller's own practice, not a period set by the Board. If a regulation specific to your sector requires recording and retention, the period is read from that regulation.

Fixed figures often repeated online, such as camera footage being kept for 30 days, do not appear in the data protection texts. The period follows from the purpose, is written into the policy, and the recorder is configured to match it.

Can a camera record audio, and who can access the footage?

According to the announcement, cameras with an audio recording feature are an extremely intrusive method as regards the privacy of private life and should not be used without a clear demonstration of a lawful justification and of necessity. Board decision 2023/2007 shows what follows. In a case where the camera in a security cabin recorded audio alongside video, the Board considered that while video recording was sufficient for the security purpose, the data controller had no legitimate interest in the audio recording and that the processing rested on none of the conditions in Article 5 of the Law. The data controller was fined ₺125,000 and instructed to destroy the audio recordings.

On access, the announcement asks for three things: technical and organisational measures such as an authorisation matrix and prevention of unauthorised access; footage not being shared with unauthorised people without permission and only authorised people having access; and a written procedure setting out who may access it and how footage is managed and recorded. Giving footage to a third party is a transfer within the meaning of Article 8 of the Law and needs its own legal ground; the recipient group is stated in the privacy notice. Footage circulating in in-store messaging groups or on social media falls outside these rules.

1. Separate the permissionsLive viewing, viewing recordings, exporting recordings and deleting them are separate permissions. A store manager may see live images; the export permission goes to a narrow role such as loss prevention.
2. Use personal accountsNobody logs into the recorder with a shared username and password; only a personal account shows who logged in.
3. Log accessWho watched which camera, for which time range, and what they exported is recorded. That log is the first document asked for in a complaint or an inspection.
4. Open an incident fileFor every exported piece of footage, the incident, the justification, the recipient and the end of retention are recorded. When the process ends the clip is deleted and a destruction record is kept.
5. Review the access list regularlyAccess is closed for an employee who changes role or leaves; the list of authorised people is re-approved at set intervals.

These steps are one worked example of the authorisation matrix, prevention of unauthorised access and access procedure expected by the announcement; they are not the only correct arrangement.

How to reduce personal data risk in camera analytics and people counting

The same camera can be used for more than security: counting the visitors entering the store, seeing how much each area is used, matching a till incident to a sales record. The first point here is this: the output being a number does not mean the image was not processed. The analysis runs on camera footage, and that stage is personal data processing.

The second point is purpose. The announcement requires the purpose to be fixed in advance and use outside that purpose to be avoided; the Communiqué on the obligation to inform also requires a separate notice for the new purpose, before processing begins, whenever the purpose of processing changes. Using a camera installed for security to count visitors or analyse footfall density is therefore a new purpose: its legal ground is assessed separately, and it goes on the sign and into the privacy notice.

The third point is the form of the output. The Law and the Regulation define anonymisation as rendering data incapable of being associated with an identified or identifiable person, even when matched with other data. A total entry count at store and hour level can be designed to meet that definition; once an identity or a trace that follows a person over time is kept, there is personal data again. When the result of the analysis is stored as a number rather than as a person, less data is kept and the report itself carries no information about an individual.

The fourth point is recognition. Biometric data is special category personal data under Article 6 of the Law. In decision 2022/797 the Board found the use of a facial recognition system for clocking in and out unlawful, because there was no valid explicit consent or other condition under Article 6, imposed an administrative fine of ₺500,000 and required the biometric data processing to stop. Visitor counting and footfall analysis do not require knowing who a person is; once a feature that recognises the individual is added, the processing enters a far stricter regime. Finally, the output is not turned into the productivity and performance monitoring that the announcement does not treat as legitimate: it is read at area and hour level, not at the level of a single employee.

The left-hand column of the table shows design options that reduce data; on their own they do not make processing lawful. Purpose, legal ground, notice and retention period are still determined separately.

How camera data is used in Mindpera

Mind Cam processes the footage from store cameras with vision analysis to produce event and visitor counting data. Visitors are counted by store and by hour; because visitor and sales figures sit in the same time interval, conversion can be calculated. A density map shows how much each area inside the store is used. Every event is recorded with its store, area, event type and time; the till variance record and the camera event at the same moment are placed side by side, so an investigation starts from the matching event rather than from scanning footage.

What the camera is used for, the privacy notice, the retention period and who may access the footage are the business's decisions as data controller. Installing an analytics product does not remove those obligations and does not make a business compliant by itself; these decisions are put in writing before installation, and the analytics purpose is added to the privacy notice.

• Vision analysis: camera footage is turned into event and counting data
• Visitor counting: entry counts broken down by store and hour
• Density map: how much each area inside the store is used
• Till matching and anomaly alerts: an unmatched till event and unusual movement raise an alert

Where camera, till and sales data sit in different systems, they are brought into a single data model during installation.