How Should KVKK and Guest Data Be Managed in Hotels?

A hotel may hold far more information about a guest than we think.

The guest's:

• first name,
• surname,
• Turkish ID number,
• passport details,
• telephone number,
• e-mail address,
• address,
• reservation dates,
• which room they stayed in,
• payment details,
• invoice,
• vehicle plate,
• camera footage,
• certain technical records relating to Wi-Fi use,
• special requests,
• previous stays

may be held in different systems.

Some hotels go beyond even this.

In the PMS, notes like these may be kept:

"Doesn't want a goose-down pillow."

"Wants a gluten-free breakfast."

"Birthday is 18 July."

"Coming for their wedding anniversary."

This information can improve the guest experience.

But it also brings with it an important question for the hotel:

Do we really have the right to process all of this data, and how are we protecting it?

From the standpoint of KVKK (the Personal Data Protection Law), the key issue is not:

"The guest gave us the information themselves."

The real issue is whether you can answer these questions:

Why are we collecting which data?
What legal basis do we rely on?
How long do we keep it?
Who can access it?
Who do we share it with?
Does it go abroad?
What do we do when the purpose of processing ends?

That is why it is a big mistake to see KVKK in hotels as:

a privacy policy placed at the bottom of the website.

KVKK is a data management system that continues from the moment guest data enters the hotel until it is deleted or anonymized.

1. A Hotel Is Actually a Large Data-Processing Operation

Data processing can begin before the guest even arrives at the hotel.

For example, a guest may touch different points in the chain of:

Google
↓
the hotel website
↓
the booking engine
↓
PMS
↓
the payment system
↓
OTA
↓
e-mail
↓
WhatsApp
↓
check-in
↓
KBS
↓
Wi-Fi
↓
cameras
↓
restaurant/POS
↓
invoice
↓
CRM
↓
marketing

So personal data is not only at reception.

It may be spread across nearly the whole of the hotel's digital ecosystem.

The first thing to do, therefore, should be:

To see the journey of data within the hotel.

2. What Is the Basic Logic of KVKK?

Under Personal Data Protection Law No. 6698, one of the basic principles in processing personal data is not:

"We might need it, so let's keep it."

Personal data processing must be carried out:

• in compliance with the law and rules of good faith,
• accurately and, where necessary, kept up to date,
• for specified, explicit, and legitimate purposes,
• in a manner connected with, limited to, and proportionate to those purposes,
• for as long as necessary.

In hospitality terms we can put it more simply:

Don't collect data you don't need. Don't use it more than necessary. Don't keep it longer than necessary. Don't show it to people who don't need it.

These four principles form the basis of a good hotel data management system.

3. You Don't Need to Obtain Explicit Consent for Every Piece of Data

One of the most common mistakes on KVKK is the approach of:

"We got the guest's KVKK approval, so now we can process all the data."

This is not correct.

The legal basis for a personal data processing activity does not always have to be explicit consent.

For example, some data may rely on other processing conditions provided in the Law, such as:

• being expressly provided for by law,
• the formation or performance of a contract,
• the data controller's legal obligation,
• the establishment, exercise, or protection of a right,
• legitimate interest, provided it does not harm fundamental rights and freedoms.

So the right question is not:

"Did we get explicit consent?"

but:

"What is the legal basis for this data processing activity?"

4. A Privacy Notice and Explicit Consent Are Not the Same Thing

This distinction is very important for hotels.

Privacy Notice (Disclosure)

Telling the guest:

• who the data controller is,
• which data is processed for which purposes,
• to whom and for what purposes it may be transferred,
• how the data is collected,
• the legal basis,
• their rights under KVKK.

Explicit Consent

A declaration of will given regarding a specific data processing activity within the conditions set out in the Law.

These are not the same transaction.

So trying to resolve everything with a single tick box such as:

"I accept the KVKK text"

is not right.

The privacy notice obligation and the activities that require explicit consent should be kept separate.

5. Make the Guest Privacy Notice Part of the Check-In System

When processing guest data, the hotel must fulfil its notice obligation.

At the least, the notice should include:

• the identity of the data controller,
• the purposes of data processing,
• to whom and for what purpose data may be transferred,
• the method of data collection,
• the legal basis,
• the data subject's rights.

But putting an 8-page legal text in front of the guest at reception is not a good user experience.

A better approach may be a layered notice.

For example, on the check-in screen, a link can be offered:

Short Notice
↓
Detailed KVKK Privacy Notice

The same approach can be applied to web bookings.

But what matters is:

That the guest can genuinely access the information.

6. "I Have Read and Accept" Is Not Always Required

The notice obligation is not conditional on the guest's approval.

The hotel's duty is to provide the required information.

So the notice should not be presented as:

"If you don't accept, you can't stay at the hotel."

Also, the notice and explicit consent should not be merged under the same tick box.

For example, instead of broad wording like:

☐ I have read the KVKK text and consent to all processing.

the legal bases of the data processing activities should be determined separately.

7. Is Explicit Consent Needed for Identity Notification?

In the previous article we covered KBS.

Because of the hotel's obligations under Identity Notification Law No. 1774, the processing of certain identity details takes place under a legal obligation.

So saying:

"The guest didn't give explicit consent for the KBS notification"

does not remove the legal notification obligation.

The legal basis for that processing is different from explicit consent.

But this also does not mean:

the hotel can keep whatever it likes about the guest's identity.

And here, in 2025, a very important decision emerged for the hospitality sector.

8. Hotels Should No Longer Take Photocopies of Turkish ID Cards

The Personal Data Protection Board's Principle Decision No. 2025/2120 of 6 November 2025 is extremely important for the hospitality sector.

The basic approach of the decision is this:

Processing the necessary identity details of the person staying, such as their:

• first name,
• surname,
• Turkish ID number,

within the scope of legislation is possible.

The hotel can view the guest's Turkish ID document in order to check the accuracy of the details.

But:

Taking and storing a photocopy of the Turkish ID document has been assessed as processing more data than necessary.

The Board has asked for this practice to be ended.

So the reception SOP should set up the flow:

Take the ID
→ verify the required details
→ enter the required data into the system
→ return the ID to the guest

The old habit of:

Photocopy the ID
→ put it in the file

should be abandoned.

9. Don't Forget the Old ID Photocopies Either

The 2025 Principle Decision does not only say that ID photocopies should not be taken from now on.

It also states that data controllers who hold on record photocopies of Turkish ID documents of guests who stayed before the decision must destroy these documents in line with Article 7 of the Law.

That is why existing hotels need to carry out a significant one-off exercise:

An archive sweep.

Places that can be checked:

• reception folders,
• physical guest files,
• scanned documents,
• computer folders,
• e-mail attachments,
• shared network folders,
• old PMS attachments.

Unnecessary ID copies found in the old system should be identified.

10. Don't Automatically Keep Passport Copies Either

For foreign guests, passport details may be necessary for KBS and operations.

But:

passport information being necessary

and

keeping the full image of the passport for years

are not the same thing.

A passport image may contain additional information that isn't necessary for the purpose of processing.

So in foreign guest processes too, this question should be asked:

Which information is really necessary?

If a passport scanning/OCR system is used, you should check whether the system uses the image only to read it or also stores it.

11. The PMS Is One of the Hotel's Most Critical Personal Data Systems

A large amount of personal data can be found in the PMS:

• first and last name,
• contact details,
• reservation history,
• room details,
• payment details,
• invoice details,
• guest preferences,
• notes.

That is why PMS access should not be of the kind:

"Everyone who works at the hotel can see it."

Role-based authorization should be used.

For example:

Reception

Guest information needed for operations.

Housekeeping

Limited information needed for room status and tasks.

F&B

Reservation/room account information if needed.

Accounting

Information needed for invoicing and finance.

Management

Access as required by the role.

Technical service has no need to see a guest's passport number.

Housekeeping has no need to access credit card details either.

The basic principle:

Data as required by the job.

12. Watch the Guest Notes Inside the PMS

In hospitality, guest notes are very useful.

For example:

"Prefers a quiet room."

"Wants a high floor."

"Wants an extra pillow."

These can improve service quality.

But staff sometimes write unnecessary or inappropriate notes.

For example:

"Very problematic guest."

"Argued with their spouse."

"Seems to have a psychological problem."

"Takes medication."

Notes like these can create serious personal data problems.

That is why a Guest Note Writing Standard should be created for the PMS.

The rule can be simple:

If it isn't necessary for operations, don't write it.

13. Pay Particular Attention to Health Information

Under KVKK, health data falls into the category of special categories of personal data.

Hotels sometimes process health data without realizing it.

For example, information such as:

"The guest is diabetic."

"Has a heart condition."

"Uses a wheelchair."

"Is allergic to this medication."

may come up.

Data like this should not be thought of as an ordinary guest preference.

The processing of special categories of personal data is subject to the special conditions in Article 6 of the Law and requires a stricter approach to security.

So the approach of:

"The guest told us, we wrote it in the PMS"

is not right.

14. Manage Food Allergy Notes in a Controlled Way Too

From the restaurant's point of view, information like:

"Has a peanut allergy"

can be vital.

But it can also be data relating to a person's health condition.

This kind of information therefore needs to be processed:

• to the extent it is genuinely necessary,
• within the right legal framework,
• so that only the employees who need it can access it,
• without being kept longer than necessary.

For example, kitchen staff have no need for:

the guest's passport number.

But at service they may need to know:

that there is a peanut allergy.

Again:

Data as required by the job.

15. Data Coming from OTAs Is Also Part of Your Data Ecosystem

A guest may have booked through:

• Booking.com,
• Expedia,
• another OTA,
• a travel agency,
• a tour operator.

In this case the data comes to the hotel through a third channel.

The hotel is still responsible for the personal data processing activities it carries out itself.

So it cannot be said:

"Booking sent it, we have no KVKK responsibility."

The following need to be assessed separately for data coming from the OTA:

• its transfer into the PMS,
• who accesses it,
• how long it is kept,
• whether it is used for other purposes.

16. Don't Automatically Add an OTA Guest's E-Mail to a Marketing List

The guest booked through Booking.com.

The hotel provided the stay.

This does not mean:

"Now we can send our own campaigns continuously."

Using contact details in order to fulfil the reservation and using them in the future for advertising and marketing are different activities.

That is why:

operational communication

and

marketing communication

should be kept separate.

17. Marketing Permission Must Be Managed Separately

The hotel may want to send past guests messages such as:

• campaigns,
• season openings,
• special rates,
• new year packages,
• restaurant events.

Here, in addition to KVKK, commercial electronic message legislation also comes into play.

So:

"They stayed at the hotel, they became our customer"

should not, on its own, be taken as a right to send unlimited marketing messages.

The permission/consent processes required for marketing should be set up separately.

18. Don't Make Marketing Consent a Condition of the Stay

For example, a system on the check-in screen like:

"If you do not accept campaign messages, check-in cannot be completed"

is not right.

A marketing activity that is not necessary to provide the accommodation service should be separated from the service itself.

A better system could be designed as:

Accommodation transactions → the required data processing

and separately:

☐ I would like to hear about campaigns and offers.

19. WhatsApp Can Create a Big "Shadow Database" for Hotels

WhatsApp is extremely common in boutique hotels.

A guest might say:

"I'd like an airport transfer."

"I'm sending my passport."

"Please invoice this company."

"Prepare a bed for my child."

After a while, the hotel's real database is not only the PMS.

There is also data in:

• the reception phone,
• employees' personal phones,
• WhatsApp groups,
• e-mail inboxes,
• screenshots.

We can call this structure a shadow database.

And in most hotels the biggest KVKK risk comes not from the official PMS but from these uncontrolled side channels.

20. Don't Manage Guest Data from Staff Members' Personal Phones

For example, a receptionist sends a WhatsApp message to a guest from their own phone.

The guest sends a photo of their passport.

Three months later the employee leaves the job.

Where is the passport image?

On the former employee's personal phone.

That is the problem.

As far as possible, the following should be used:

• a company phone,
• a company WhatsApp account,
• company e-mail,
• a controlled PMS/CRM.

It should be possible to close access when an employee leaves.

21. See E-Mail Inboxes as a Data System Too

Hotel e-mails may contain:

• reservation details,
• passport images,
• company invoice details,
• credit card requests,
• transfer details,
• guest complaints.

So e-mail can become a:

personal data store

as much as a

communication tool.

Keeping unnecessary attachments in the inbox for years is not good data management.

22. Don't Ask for Credit Card Details by E-Mail or WhatsApp

Payment security is a critical issue not only under KVKK but also from the standpoint of payment system security.

Asking the guest:

"Send a photo of the front and back of the card on WhatsApp"

is an extremely risky practice.

As far as possible, payment transactions should be carried out through:

• a secure payment infrastructure,
• a virtual POS,
• systems that support tokenization,
• secure booking engines.

The hotel's need should be not:

to know the card number

but:

to take the payment securely.

23. Security Cameras Also Process Personal Data

The hotel may have cameras at its:

• entrance,
• lobby,
• car park,
• corridors,
• common areas.

Because real individuals can be identified in camera footage, this is a personal data processing activity.

That is why the following should be planned:

• the camera's purpose,
• camera location,
• retention period,
• access permissions,
• security,
• the privacy notice.

Cameras should not be used with the logic of:

"It's for security; we can put them wherever we like."

24. Limit the Camera's Field of View to Its Purpose

Cameras used for security should be proportionate to the security need.

For example, in areas where the expectation of privacy is extremely high, such as:

• guest rooms,
• bathrooms,
• changing areas,

camera use cannot be considered an acceptable security method.

Even in common areas, this question should be asked:

Does the camera really need to see this area?

The aim should be not:

to collect as much footage as possible

but:

to provide the necessary security with the most limited data possible.

25. Don't Keep Camera Recordings Forever

The Personal Data Protection Authority specifically stresses that security camera recordings should not be kept longer than necessary.

So:

"We record until the disk is full"

is not a good retention policy.

The retention period should be set on the basis of:

• the purpose of use,
• the facility's risk profile,
• the relevant legislation,
• real operational need.

The shortest sufficient period possible should be preferred, and automatic deletion mechanisms should be used.

If an incident has occurred, it may be necessary to preserve only the relevant footage separately for legal proceedings.

26. Who Has Access to the Camera Recordings?

This question isn't asked enough in most hotels.

The camera screen may be:

• at reception,
• in security,
• in the manager's office.

But who can rewind the recordings?

Who can copy them to a USB drive?

Who can share them on WhatsApp?

In a good system, the following can be defined separately:

• live view access,
• access to past recordings,
• permission to export recordings.

Knowing the camera's password should not mean having the authority to use the footage.

27. Guest Wi-Fi Must Also Be Included in the Data Map

A hotel Wi-Fi system can generate various kinds of data, such as:

• device information,
• IP/log data,
• connection times,
• authentication details.

In this area, in addition to KVKK, other legislation on electronic communications and internet access may also come into play.

So saying:

"We called the Wi-Fi company, they set up the system"

is not enough.

These should be asked:

• what data is kept?
• why is it kept?
• where is it kept?
• how long is it kept?
• who can access it?
• does the service provider use the data?
• is the server in Turkey or abroad?

28. If You Use a Cloud PMS, Ask Where the Data Is

Modern hotels use more and more cloud systems.

For example, the following may run on servers abroad:

• PMS,
• channel manager,
• CRM,
• booking engine,
• e-mail,
• analytics,
• customer support software.

In this case the transfer of personal data abroad may come into play.

The regime for transferring data abroad in Turkey changed significantly in 2024.

The new system includes mechanisms such as:

• adequacy decisions,
• appropriate safeguards,
• standard contracts,
• binding corporate rules,
• certain exceptional transfer cases.

So:

"The program is foreign but we use it from Turkey"

may not mean there is no transfer of data abroad.

29. Map the Data of All the Software the Hotel Uses

You can create a simple table:

In preparing this table, many hotels face for the first time the fact that:

"We don't actually know where our data is."

This awareness is the beginning of a KVKK system.

30. Review Your Suppliers from a KVKK Perspective Too

The hotel may not process personal data on its own.

For example, the following may access the data:

• the PMS company,
• the IT company,
• the cloud provider,
• the call center,
• the digital marketing agency,
• the CRM company,
• the accounting firm.

That is why supplier contracts should be reviewed for:

• which data is accessed,
• for what purpose it is processed,
• security obligations,
• sub-processors,
• data breach notification,
• what happens to the data when the service ends,
• any transfer abroad.

31. Check Your VERBİS Obligation

Under KVKK, some data controllers have an obligation to register with the Data Controllers' Registry — VERBİS.

But not all businesses are automatically required to register with VERBİS.

There are exceptions and current criteria set by the Board.

So an assumption like:

"We're a hotel, we definitely have to register with VERBİS"

or

"We're a small hotel, we're definitely exempt"

should not be made.

The obligation should be checked on the basis of the business's:

• number of employees,
• financial structure,
• main field of activity,
• types of data processed,
• current Board decisions.

32. Create a Data Inventory

For a good KVKK system, the hotel needs to know which personal data it processes.

For example:

Guest

• identity,
• contact,
• reservation,
• payment,
• invoice,
• camera,
• preferences.

Employee

• identity,
• SGK,
• payroll,
• bank,
• health,
• training.

Supplier

• contact,
• finance,
• contract.

Website Visitor

• cookies,
• IP,
• analytics.

The following questions should be answered for each piece of data:

What are we collecting?
Why?
Legal basis?
Where does it come from?
Where does it go?
Who accesses it?
How long do we keep it?
How do we destroy it?

33. Don't Set Retention Periods as "Forever"

The fact that a PMS can technically keep a guest profile indefinitely does not mean:

it can be kept indefinitely in law.

Different data may have different grounds for retention.

For example, the following do not have to have the same retention period:

• financial records,
• contracts,
• identity notification,
• cameras,
• marketing,
• customer relations.

That is why a data-specific Retention and Destruction Matrix should be created.

34. What Happens When the Reason for Retention Ends?

One of KVKK's important principles is that when the reasons requiring the processing of personal data cease to exist, the data is deleted, destroyed, or anonymized.

So in the hotel system, it should not be:

Collect
→ Use
→ Store
→ Forget

The right flow should be:

Collect
→ Use
→ Keep for the necessary period
→ Check the period
→ Delete / destroy / anonymize

35. Don't Forget Physical Documents Either

KVKK does not cover only computer data.

The following in the reception cabinet:

• old registration forms,
• printed reservations,
• invoices,
• personnel files,
• ID photocopies

can also contain personal data.

So in the data inventory, you should consider:

digital + physical

together.

36. The Trash Can Is Not a Method of Data Destruction

Crumpling a physical document containing personal data and throwing it in the bin is not secure destruction.

For example, an old reservation list may contain:

• names,
• phone numbers,
• rooms,
• stay dates.

Documents like this should be destroyed appropriately.

The same principle applies to digital files.

Pressing the delete key may not, in every case, mean secure destruction.

37. Set Up Staff Access on a Role Basis

One of the most important technical/administrative measures in a KVKK system is access control.

For example, your PMS roles could be:

Reception

Night Auditor

Front Office Manager

Housekeeping

Finance

General Manager

Each role should access only the screens it needs.

This approach is the principle of:

Least Privilege

Staff should be able to access not as much as they can, but as much as their job requires.

38. Reduce Shared User Accounts

For example, if all of reception uses the account:

reception / 123456

you can't know who did it when data is changed.

As far as possible, individual user accounts should be used.

That way, the following are managed more securely:

• access control,
• log tracking,
• error analysis,
• employee departures.

39. Carry Out Digital Offboarding When Staff Leave

The employee has left the job.

The SGK exit has been filed.

They handed back their uniform.

But:

• their PMS account is open,
• their e-mail still works,
• their Google Drive access continues,
• they are still in the WhatsApp group,
• they know the camera system's password.

This is a serious data security risk.

The offboarding checklist should check access to:

PMS
+
e-mail
+
POS
+
CRM
+
KBS
+
Wi-Fi management
+
CCTV
+
cloud storage
+
WhatsApp/communication groups

40. What Is a Data Breach?

An employee sends the guest list to the wrong e-mail address.

A laptop is stolen.

A PMS account is taken over.

Guest passports leak onto the internet.

Camera footage is shared without authorization.

A former employee copies CRM data.

Some of these may constitute a personal data breach.

The answer to the question:

"What do we do if something like this happens?"

should be prepared before the incident.

41. In a Data Breach, 72 Hours Is Critical

According to the Personal Data Protection Board's current decision, where it is learned that personal data has been obtained by others through unlawful means, the data controller must notify the Board without delay and within 72 hours at the latest.

Notification should also be made to the affected data subjects, depending on the circumstances, in the shortest reasonable time.

That is why the approach of:

"Let the IT company investigate, management will decide next week"

can create serious risk.

The hotel should have a Data Breach Response Plan.

42. What Could a Data Breach Procedure Look Like?

A simple flow:

A suspicious incident is detected
↓
Secure the system
↓
Inform the KVKK officer / management
↓
What data was affected?
↓
How many people were affected?
↓
When did the breach begin?
↓
When was it learned of?
↓
What is the risk?
↓
Required legal assessment
↓
Notification to the KVKK Board
↓
If needed, informing the data subjects
↓
Root cause analysis
↓
Corrective action

One of the most critical points:

Record the time the breach was learned of.

Because this time matters in the 72-hour assessment.

43. Manage KVKK with Decision Gates

We can apply the decision gates system we use in this series here too.

Decision Gate 1 — Data

Which personal data are we collecting?

Clear → Move on to purpose.

Unclear → Build a data inventory.

Decision Gate 2 — Purpose

Why do we really need this data?

Clear and legitimate → Move on to the legal basis.

Unnecessary → Don't collect it.

Decision Gate 3 — Legal Basis

Which processing condition in the Law are we relying on?

Clear → Proceed.

Unclear → Assess it before starting the processing activity.

Decision Gate 4 — Privacy Notice

Have we given the guest the required notice?

Yes → Proceed.

No → Set up the notice system.

Decision Gate 5 — Explicit Consent

Does this activity really rest on explicit consent?

No → Don't try to collect consent; use the right legal basis.

Yes → Obtain explicit consent separately from the notice and in an appropriate manner.

Decision Gate 6 — Data Minimization

Are all the fields we collect really necessary?

Yes → Proceed.

No → Remove the unnecessary fields.

Decision Gate 7 — Access

Who needs to see this data?

Clear → Grant role-based permission.

Unclear → Don't grant access.

Decision Gate 8 — Transfer

Is the data going to another company or abroad?

No → Move on to retention.

Yes → Check the legal framework for the transfer.

Decision Gate 9 — Retention

How long do we need to keep this data?

Clear → Create a retention matrix.

Unclear → Don't use the "forever" assumption.

Decision Gate 10 — Destruction

Have the purpose of processing and the legal ground for retention ended?

No → Keep it securely.

Yes → Delete / destroy / anonymize.

Decision Gate 11 — Breach

Has a data security incident occurred?

No → Continue monitoring.

Yes → Activate the breach response plan immediately.

This last gate never closes as long as the hotel operates.

44. 20 Common KVKK Mistakes Made in Hotels

1. Seeing KVKK as only a website text

The operation is overlooked.

2. Asking for explicit consent for every piece of data

Legal bases are set up wrongly.

3. Merging the privacy notice and explicit consent in one tick box

Two separate processes are confused.

4. Taking Turkish ID photocopies

The 2025 Principle Decision is overlooked.

5. Continuing to keep old ID photocopies in the archive

Unnecessary data is retained.

6. Storing passport images without control

More data than necessary may be kept.

7. Writing unnecessary guest notes in the PMS

Non-operational data accumulates.

8. Recording health information like an ordinary preference

A special-category data risk arises.

9. Adding an OTA customer to the marketing list automatically

The purposes of accommodation and marketing are confused.

10. Making marketing permission a condition of check-in

The nature of the consent may be undermined.

11. Keeping guest data on staff members' personal phones

Control is lost.

12. Sharing IDs and passports in a WhatsApp group

A shadow database is created.

13. Asking for a card photo over WhatsApp

Financial and personal data risk is created.

14. Keeping camera recordings for years

Proportionality is lost.

15. Giving every staff member full access in the PMS

The principle of least privilege is not applied.

16. Using a shared user account

Who did what cannot be traced.

17. Not knowing the server location of cloud software

Transfers abroad may be overlooked.

18. Not checking supplier access

The outer links of the data chain are forgotten.

19. Not closing access when staff leave

A former employee may continue to access the system.

20. Having no data breach plan

The critical 72-hour period may pass uncontrolled.

45. KVKK Checklist for Hotels

Data Inventory

• ☐ Guest data has been listed.
• ☐ Employee data has been listed.
• ☐ Supplier data has been listed.
• ☐ Web/cookie data has been listed.
• ☐ Physical archives have been listed.
• ☐ The PMS has been checked.
• ☐ OTA data has been checked.
• ☐ The CRM has been checked.
• ☐ E-mail has been checked.
• ☐ WhatsApp processes have been checked.
• ☐ CCTV has been checked.
• ☐ The Wi-Fi system has been checked.

Legal Framework

• ☐ Each processing purpose has been determined.
• ☐ A legal basis has been determined for each processing activity.
• ☐ Activities requiring explicit consent have been separated out.
• ☐ Privacy notices have been prepared.
• ☐ Privacy notice and explicit consent have been separated.
• ☐ The VERBİS obligation has been checked.

Check-In

• ☐ Required identity details are taken.
• ☐ Turkish ID photocopies are not taken.
• ☐ An archive sweep for old ID photocopies has been done.
• ☐ Passport processes have been arranged in line with data minimization.
• ☐ The privacy notice is accessible.
• ☐ Reception staff have been trained.

PMS

• ☐ Users are individual.
• ☐ Roles have been created.
• ☐ Permissions are role-based.
• ☐ Unnecessary guest notes are prevented.
• ☐ Special-category data processes are under control.
• ☐ Departing staff's access is closed.
• ☐ Log records are reviewed.

Marketing

• ☐ Operational communication and marketing are separated.
• ☐ Marketing permissions are managed separately.
• ☐ OTA guests are not added to the list automatically.
• ☐ An opt-out/refusal mechanism exists.
• ☐ Permission records can be proven.

Cameras

• ☐ The camera purpose is defined.
• ☐ Fields of view have been checked.
• ☐ The privacy notice is provided.
• ☐ The retention period has been determined.
• ☐ Automatic deletion has been considered.
• ☐ Access is limited.
• ☐ Export permission is controlled.

Digital Systems

• ☐ The PMS provider has been reviewed.
• ☐ The channel manager has been reviewed.
• ☐ The booking engine has been reviewed.
• ☐ The CRM has been reviewed.
• ☐ The e-mail provider has been reviewed.
• ☐ Cloud storage has been reviewed.
• ☐ The Wi-Fi system has been reviewed.
• ☐ Server locations are known.
• ☐ Transfers abroad have been checked.

Suppliers

• ☐ Suppliers with data access have been listed.
• ☐ Contracts have been checked.
• ☐ Confidentiality obligations have been set out.
• ☐ Security measures have been assessed.
• ☐ Sub-processors have been checked.
• ☐ A data breach notification process has been defined.
• ☐ Data destruction at the end of service has been arranged.

Retention and Destruction

• ☐ A retention matrix has been prepared.
• ☐ Legal retention periods have been assessed.
• ☐ Unnecessary physical documents are being identified.
• ☐ A digital deletion procedure exists.
• ☐ A physical destruction procedure exists.
• ☐ A periodic destruction system has been considered.
• ☐ Processes requiring anonymization have been identified.

Data Security

• ☐ A strong password policy exists.
• ☐ An access matrix exists.
• ☐ Individual user accounts exist.
• ☐ A backup system exists.
• ☐ Updates are tracked.
• ☐ Staff receive KVKK training.
• ☐ Personal phone use has been restricted.
• ☐ An offboarding checklist exists.

Data Breach

• ☐ A data breach procedure is ready.
• ☐ The response team is identified.
• ☐ The legal lead is identified.
• ☐ The IT lead is identified.
• ☐ The time the breach is learned of is recorded.
• ☐ The 72-hour rule is known.
• ☐ A data subject notification process is defined.
• ☐ Root cause analysis is carried out.
• ☐ A corrective action system exists.

46. What Should the Right Data Management Flow Look Like in a Hotel?

Let's summarize the whole system in a single flow:

Identifying guest touchpoints
↓
Data inventory
↓
Determining processing purposes
↓
Legal bases
↓
Data minimization
↓
Privacy notice
↓
Explicit consent, if needed
↓
Reservation
↓
Check-in / KBS
↓
PMS
↓
In-hotel operations
↓
Access control
↓
Supplier / system transfers
↓
Transfer-abroad check
↓
Marketing permissions
↓
Retention period
↓
Deletion / destruction / anonymization
↓
Data security
↓
Breach management
↓
Periodic audit
↓
Continuous KVKK compliance

The most important principle here:

Don't collect data first and think later about why you collected it. First determine why you need it, then collect only the data that is needed.

Conclusion

In hospitality, data is very valuable.

Knowing the guest can raise service quality.

Knowing their previous stay can personalize the experience.

Remembering their preferences can increase loyalty.

Using a CRM can directly improve bookings.

But:

More data does not always mean better hospitality.

Data you cannot control becomes a risk.

The unnecessary note in the PMS.

The old ID photocopy.

The passport photo on WhatsApp.

The guest list on an employee's personal phone.

The camera footage that hasn't been deleted for years.

The Excel file nobody remembers.

The open PMS account of a former employee.

The cloud software that runs abroad and whose data transfer nobody has reviewed.

All of these are the hotel's invisible data debt.

That is why, from the investor's perspective, the right question is not:

"Do we have a KVKK text?"

The right question is:

"Is guest data under our control from the moment it enters our hotel until the moment it leaves?"

I sum up KVKK management in hotels with this equation:

Necessary data + proper legal basis + transparency + minimum access + secure systems + proper retention period + secure destruction = sustainable data management

And the 2025 Turkish ID photocopy Principle Decision is a very good example of this approach.

The hotel may need to see the ID.

It may need to verify the identity details.

It may need to record the required information.

But this does not mean:

that it needs to copy the whole document and keep it for years.

The basic logic of KVKK emerges right here:

Process the data you need. Don't collect the data you don't need.

Hotel Investment Guide — Volume III: Official Processes & Compliance

In this article I covered KVKK and guest data management in hotels, from the investor's and operator's perspective, under the headings of:

• identity and passport details,
• KBS,
• PMS,
• OTAs,
• guest notes,
• health and allergy information,
• WhatsApp and e-mail,
• marketing,
• camera systems,
• Wi-Fi,
• cloud software,
• transfer of data abroad,
• suppliers,
• VERBİS,
• retention and destruction,
• staff access,
• data breaches.

In Hotel Investment Guide — Volume III, I address personal data management more comprehensively, together with guest records, KBS, employee data, contracts, legal risk, and the continuous compliance system.

The aim is not only to answer the question "How is a KVKK text prepared?" but to show how a real data management system that works across the whole hotel is built.

Important Note: Legislation on the protection of personal data, transfers of data abroad, VERBİS, commercial electronic messages, electronic systems, and related secondary legislation may change over time. Obligations may also vary according to the systems the hotel uses, its data categories, its company structure, and its data processing activities. This article is for general information only. Before implementation, current legislation and Personal Data Protection Board decisions should be checked; where necessary, support should be sought from a lawyer specializing in KVKK and from information security specialists.