KVKK and guest Wi-Fi: is a phone number special category data?

Guest Wi-Fi collects little data, but it is personal: a phone number or e-mail address, device details, connection times. That data falls under Türkiye's personal data protection law (KVKK).

This article covers what to do in practice, and corrects a common mistake.

The common error: "a phone number is special category data"

It is not.

KVKK article 6 defines special category personal data as a closed list:

"ırkı, etnik kökeni, siyasi düşüncesi, felsefi inancı, dini, mezhebi veya diğer inançları, kılık ve kıyafeti, dernek, vakıf ya da sendika üyeliği, sağlığı, cinsel hayatı, ceza mahkûmiyeti ve güvenlik tedbirleriyle ilgili verileri ile biyometrik ve genetik verileri" (race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sex life, criminal convictions and security measures, together with biometric and genetic data)

Phone numbers, e-mail addresses and national ID numbers are not on that list. They are ordinary personal data.

This distinction helps you: special category data requires much stricter processing conditions and additional security measures. Because guest Wi-Fi data is not in that category, your burden is lighter.

"Ordinary" does not mean "unimportant", though. The duties below apply in full.

Note: KVKK article 6 was amended in 2024 by Law No. 7499. Sources predating 2024 are out of date on this article.

The duty to inform

The guest must learn at sign-in that their data is being processed. The privacy notice should state:

• Who the data controller is (your business name)
• What is collected (phone number, device details, connection time)
• The purpose (identifying the user and meeting the legal logging duty)
• How long it is kept
• Who it may be passed to (your SMS provider, if any)
• The individual's rights and how to exercise them

The text must be readable on the sign-in screen. A page hidden behind a small link that nobody opens does not count.

Explicit consent: always needed?

There is an important distinction here.

Keeping access records is a legal obligation. KVKK article 5/2 allows processing necessary to fulfil a legal obligation without explicit consent. So you do not need separate consent from the guest in order to keep the record.

Explicit consent is needed when you go beyond the legal obligation. For example:

• Using the guest's number later to send campaign messages
• Analysing visit habits for marketing
• Sharing the data with a business partner

Those need separate, explicit consent. The critical point: that consent must be its own checkbox. Merging privacy acknowledgement with marketing consent in one box is not correct.

Under the article 3 definition, consent must be "declared with free will". A box that arrives pre-ticked does not meet that definition.

Data security: article 12

Data security duties sit in KVKK article 12. That is literally the article's heading: "Veri güvenliğine ilişkin yükümlülükler".

What that means in a guest Wi-Fi context:

• Store contact data encrypted. A phone number should not sit in the database in clear text.
• Limit access. Who can enter the admin panel should be defined; not everyone should see everything.
• Keep an audit trail. Who did what and when should be recorded.
• Serve the portal over HTTPS. A guest typing their phone number into an unencrypted page is not acceptable.
• Do not expose the admin interface to the internet. If you must, at least put a second verification layer in front of it.

Data minimisation

The most common mistake is collecting more than needed. Asking for name, surname, date of birth, gender and occupation on the sign-in form both slows the guest down and creates a position that is hard to defend under KVKK.

The question to ask is simple: "Why am I collecting this field?" If the answer is "it might come in handy", remove it.

One contact detail is enough to identify a user.

Retention and deletion

Two duties meet here:

• The 5651 framework requires access records to be kept for two years.
• KVKK expects data whose purpose has ended to be deleted.

The practical result: set up automatic deletion of records older than two years. You meet the retention duty and avoid holding needless data.

The SMS provider and data transfer

To send a text to a guest, their phone number is passed to an SMS provider. That is a data transfer.

Two points:

1. The privacy notice should mention that transfer.
2. The relationship with your provider is expected to be defined by contract.

This is why the number of intermediaries a guest's phone number passes through matters. A number going straight from the box to the provider is a simpler arrangement than one routed through a third platform.

Checklist

• Is the privacy notice readable on the sign-in screen?
• Is marketing consent a separate checkbox?
• Does any checkbox arrive pre-ticked?
• Is the phone number encrypted in the database?
• Is the portal served over HTTPS?
• Is admin panel access limited and logged?
• Are records older than two years deleted?
• Are you collecting any field you do not genuinely need?

---

This article is for information only and is not legal advice. Consult a lawyer about your own situation. Quotations are taken from the legislation as it stood on the date of publication.