Digital Business Card Data Privacy Under Turkish KVKK

Yes, you can put employee names and work contacts on a digital business card under KVKK, but you must pick a legal basis, inform the person and remove the card when they leave. Here is how to handle each of those steps in practice.

Is an employee's work contact information personal data?

Yes. A name, job title, work email and direct phone number all point to an identifiable person. KVKK (Law No. 6698) treats them as personal data, even when they appear on a company-issued card.

A digital card differs from a paper one in one important way. It is public, searchable and easy to copy. A printed card goes to a few people. A link or QR code can travel anywhere.

That does not make digital cards risky by default. It means you need a deliberate decision about what appears on them and why.

Do you need the employee's consent?

Not always, and often it is the weaker option. Consent under KVKK must be specific, informed and given freely. In an employment relationship, an employee may feel unable to refuse, which makes consent hard to defend.

Many employers rely instead on a legitimate interest or on the necessity of the data for the business relationship. Customers need a way to reach the right person. That purpose is real and can support processing of basic work details.

Consent is more suitable for optional extras, such as a personal mobile number or a profile photo. Make these truly optional, and make sure saying no has no consequences for the employee.

Which basis applies to your situation is a legal call. Confirm it with your data protection counsel before you finalize the setup.

Which fields belong on the card?

Apply data minimization: show only what the card's purpose requires. A salesperson meeting clients needs a work email and phone. They rarely need a home city or birth date.

Think about the role. A public-facing account manager and a back-office engineer have different exposure. The same template for everyone is convenient, but it often over-shares.

• Usually fine: name, title, company, work email, work phone.
• Optional with clear agreement: personal mobile, photo, social profiles.
• Avoid: home address, national ID number, birth date, family details.
• Review fields per role, not once for the whole company.

What must the disclosure say?

KVKK requires an information notice (aydınlatma metni) before you process the data. It should say who the data controller is, why the data is used, who receives it, how it is collected and what rights the person has.

For a digital card, add practical details. Say where the card is published, whether it is indexed by search engines and whether the platform records who views it or saves the contact.

Write the notice in plain language and give it to the employee before the card goes live. Keep a dated record that they received it. If a third-party card provider hosts the data, name that relationship in the notice.

Which legal basis fits which field?

The table below is a working summary, not legal advice. Your counsel may reach a different view for your company.

What happens to the card when someone leaves?

This is where most companies slip. The employee quits, the email is closed, but the card link stays live in old proposals, email signatures and printed QR codes.

A live card with a departed employee's name misleads customers. It also keeps processing data without a purpose, which conflicts with KVKK's storage limitation principle.

Decide in advance what a dead link shows. A better choice than an error page is a short notice that redirects to a current contact or a general company address.

• Add card deactivation to the exit checklist alongside email and system access.
• Assign one person who owns the task, usually HR or IT.
• Redirect the old link to a team contact.
• Confirm the provider deletes the data, not just hides the card.
• Log the date of removal.

What should you check in the card platform itself?

The platform processes data on your behalf, so you remain responsible. Ask where the data is stored, whether it moves abroad and whether a data processing agreement is in place. Cross-border transfers have their own KVKK conditions.

Check the technical basics too: access controls for who can edit cards, an option to disable search indexing and a clear deletion process. If the platform tracks visitors, that tracking is another processing activity you must disclose.

If you are building cards as part of a company website, budget these requirements early. Our transparent price list shows how we scope web projects, so you can plan privacy work alongside the build.

What should you do this week?

Start with an inventory. List every live digital card, the fields on each and who approved them. You will probably find fields nobody can justify.

Next, draft or update the information notice, and send it to each employee with a record of receipt. Move optional fields to explicit, withdrawable agreement.

Finally, add card removal to your offboarding checklist and name the person responsible. Then ask your legal advisor or the KVKK authority's published guidance to confirm the details for your case.