Filming in a venue under KVKK: guests, staff and consent

When we film in a restaurant, a hotel or a gym, people end up in the frame: guests at their tables, waiters on the floor, cooks in the kitchen. Under KVKK, Turkey’s data-protection law (Law No. 6698, broadly comparable to the GDPR), a recognisable face is personal data. Here is how we work on shoot days, and what venues in Turkey should have in place before the cameras arrive.

A recognisable person is personal data

Filming anyone who can be identified needs a legal basis: explicit consent, or one of the other grounds the law lists. The duty to inform applies in every case. People have to be told who is processing their data, why and how.

The privacy notice and the consent form must be separate

In Turkish these are two different documents: the aydınlatma metni (privacy notice) and the açık rıza (explicit consent). A principle decision of the KVKK Board, No. 2026/347, published in the Official Gazette on 24 March 2026, is clear: they must be presented separately, with separate headings, separate texts and separate approval steps. A single “I have read and agree” checkbox is no longer enough.

On a shoot day that means two pieces of paper:

• The privacy notice: posted at the venue entrance, saying that filming is taking place, what for, and who is responsible.
• The consent form: a separate, signed form for everyone featured in the frame, with a clear scope. The scope should list the options one by one, for example internal use, the venue’s own channels, or the studio’s showreel.

Staff: an employment contract is not enough

Using an employee’s image in advertising is not needed to perform the employment contract, so it generally requires explicit consent. That consent has to be genuinely free. Give staff a real option to say no, and film around those who do.

One point that is often missed: when an employee leaves, the legal basis for keeping ads that show them lapses too. That is why it matters to know who appears in which video.

Guests and children

Sharing a recognisable guest’s image on social media requires that guest’s explicit consent. In a case reported in January 2024, the Board fined a hotel 500,000 TL for sharing a guest’s details on social media, and noted that a hotel registration form does not count as consent for marketing.

If a child is in frame, a parent’s consent is needed. Without it, the image is blurred or reframed so the child is out of shot. We treat bystanders without consent the same way: either they stay out of frame, or they become unrecognisable.

A few habits make this much easier in practice: schedule the shoot for quieter hours where possible, let seated guests know briefly that filming is happening, and keep one area of the room off-camera for anyone who prefers not to appear.

Who is responsible?

For its own guests and staff, the venue is usually the data controller. As the studio, we process the data on the venue’s behalf. We write this split into the contract and give the venue templates for the notice and the consent form. The contract also states where the footage is stored, who can access it and how long it is kept.

Our shoot-day checklist

1. A privacy notice at the venue entrance.
2. A separate consent form for everyone featured.
3. People without consent kept out of frame or blurred.
4. A consent record for every shoot: who signed, the scope, and until when.
5. Footage of anyone who withdraws consent taken out of use.
6. Footage processed locally, on our own machines.

The footage stays with us

We never upload footage showing identifiable people to a cloud service without a consent record for that shoot and explicit approval for that specific task. Editing, subtitling and archive search all run on our own hardware. We use face detection only to flag “this clip shows someone recognisable”; we do not build face recognition or systems that group people by identity.

Retention follows a simple rule: personal data is deleted within three months after the purpose for keeping it has ended.

Consent is not a form you sign once and forget. It is a record of who appears in which video, and for what use.

This article is general information, not legal advice.

If you’d like to plan a shoot at your venue with this in mind, contact us.