Why this needs its own treatment
Identity verification lands in the most sensitive corner of data protection law: biometric data is a special category of personal data under both GDPR Art. 9 and KVKK Art. 6.
The practical consequence is simple. A leaked password gets changed. A leaked ID number can have its damage contained. A leaked biometric template cannot be reissued. That is why the law puts this data under a separate regime.
The split: controller and processor
This is the part most often confused, and the obligations divide cleanly:
- The controller — you. You establish the lawful basis, provide the notice, obtain explicit consent where required, and set the retention and deletion policy.
- The processor — your provider. It processes the data only on your documented instructions and only as far as the service requires.
Where that split is not put in writing, the burden of proof stays vague at audit. A Data Processing Agreement exists precisely to close that gap.
What data minimisation means in practice
The principle of processing no more than necessary turns into three concrete decisions in a verification flow:
- Raw image or template? Processing a biometric template carries lower risk than storing a raw image.
- For how long? You set the retention period — keep no record indefinitely unless the law requires it.
- Who can reach it? Access should be limited to staff who need it for their role, and every access recorded.
What you show at audit
Compliance is not only behaving correctly; it is being able to prove you did. A timestamped record of every verification step, the checks applied and their outcomes lets you answer an audit request without assembling a file.
That record survives Zero Data Retention. What is deleted is the raw images and biometric templates; the result itself and the audit trail remain — you cut your data footprint without losing your evidence.
International transfers
Where a transfer is required, the safeguards under GDPR Chapter V and KVKK Art. 9 apply: an adequacy decision or standard contractual clauses. Put the basis for the transfer on the record at the contract stage — it is among the first things an audit will ask about.
