In brief
A worker's health information is confidential under Law No. 6331 and is special category personal data under KVKK. The contents of the health file are known to the workplace physician and the health staff working with them; the employer and human resources are told only the fitness-for-work outcome and, where needed, any work restriction. Personal health files are kept for at least 15 years from leaving employment, and for 40 years in the case of carcinogen and asbestos exposure.
Two laws, one rule: health information is confidential
Health data at work is an area where two separate laws intersect, and it is the most sensitive type of data under KVKK. Law No. 6331 places health surveillance on the employer but draws a line in the same article: to protect the private life and reputation of a worker who undergoes a medical examination, health information is kept confidential (Art. 15/5). Personal Data Protection Law No. 6698 (KVKK) lists health data as special category personal data (Art. 6/1).
The practical result of these two provisions is this: the employer is obliged to have health surveillance carried out, to have records kept and to bear the cost, but does not need to know the content of examination and test results. The Regulation on Workplace Physicians and Other Health Personnel also states explicitly that the workplace physician (Art. 11/1) and other health personnel (Art. 18/1) are obliged to keep the information in the worker's personal health file confidential.
Where does health data sit under KVKK? Processing conditions for the workplace
KVKK prohibits the processing of special category personal data as a rule and lists the exceptions. Under the third paragraph of Article 6, amended in 2024 by Law No. 7499, two exceptions stand out for health surveillance at work:
- Art. 6/3-e: Where processing is necessary for preventive medicine, medical diagnosis, treatment and care services carried out by persons under a duty of confidentiality or by authorised institutions and organisations. The workplace physician's examination and test records fall within this framework.
- Art. 6/3-f: Where processing is mandatory to fulfil legal obligations in the fields of employment, occupational health and safety and social security. Having pre-employment and periodic examinations carried out, and obtaining and keeping the fitness-for-work report, are among these obligations.
In most cases these exceptions make separate explicit consent for health surveillance unnecessary. Two conditions, however, never disappear: the worker is informed of the purpose for which their data is processed (Art. 10), and the adequate measures set by the Personal Data Protection Board are taken when processing special category data (Art. 6/4). In addition, the workplace physician is responsible for informing the worker about examinations and tests and obtaining their consent (Physicians Regulation Art. 9/1-c-1); this is an obligation relating to medical practice, separate from explicit consent under KVKK.
Who can access the health file?
Employee health file confidentiality is protected by answering the question "who sees what, and for what purpose". The table below summarises the roles commonly found at work:
| Person | What they can access | What they cannot access | Legal basis |
|---|---|---|---|
| Workplace physician | The entire personal health file | — | Physicians Reg. Art. 9, 11/1 |
| Workplace nurse (DSP) | Records referred by the physician | Records outside their duties | Physicians Reg. Art. 18/1 |
| Employer and human resources | Fitness-for-work outcome, any work restriction | Diagnosis, test values, medication | Law 6331 Art. 15/5 |
| OHS specialist | Measures recommended by the physician, exposure information | Individual diagnosis and test details | Law 6331 Art. 15/5 |
| The worker | All of their own records | Other workers' records | KVKK Art. 11 |
| New employer | A certified copy of the file on written request | — | OHS Services Reg. Art. 7/2 |
In workplaces where carcinogenic or mutagenic substances are used, workers' right to receive information on their own health surveillance results is also explicitly regulated (Carcinogenic Substances Regulation Art. 16/3).
Can the employer see the health report?
The short answer to "can the employer see the health report?" is: they see the report's outcome, not its medical content. Pre-employment and periodic examination results are drawn up in line with the template in Annex 2 and kept at the workplace (Physicians Reg. Art. 9/1-c-4). Being kept at the workplace does not mean lying open in a human resources cabinet; the file is held in a locked section under the physician's control.
The information passed to human resources is limited to what is needed for the placement decision. For example:
- "Fit for the work they will do."
- "May work in jobs other than work at height."
- "Not suitable for work in the noisy department; placement in a suitable department is recommended."
These statements do not include the name of the illness, test values or medication used. Special situations such as pregnancy, chronic illness or substance dependence are also communicated to the employer not as a diagnosis but as the physician's recommendation for suitable placement. For where to obtain the pre-employment report, see our article on the pre-employment health report, and for the frequency of tests, periodic examinations and tests.
Health file retention: period, place and handover
The OHS Services Regulation sets clear periods for health file retention:
| Record | Period | Legal basis |
|---|---|---|
| The worker's personal health file | At least 15 years from the date of leaving employment | OHS Services Reg. Art. 7/1-b |
| Records of exposure to carcinogenic or mutagenic substances | At least 40 years after exposure ends | Carcinogenic Substances Reg. Art. 17 |
| Asbestos exposure records | At least 40 years after exposure ends | Asbestos Regulation Art. 17 |
| File of a worker who has left | A certified copy on the new employer's written request, within one month | OHS Services Reg. Art. 7/2 |
If you receive services from an OSGB (joint health and safety unit), be aware of two provisions: the OSGB is responsible for keeping workers' examination and exposure records in their personal health files in accordance with the principle of confidentiality (Art. 13/1-e), and at the end of the contract it hands over all records and files to the employer, even if not requested (Art. 13/2). For how the file handover is done when changing OSGB, see our article on the OSGB change process.
For data whose retention period has expired, Article 7 of KVKK applies: when the reasons requiring processing no longer exist, the data is erased, destroyed or anonymised. Destruction should therefore not be haphazard but carried out and recorded.
KVKK compliance checklist for the workplace
KVKK requires the data controller to take the technical and administrative measures needed to prevent unlawful access to data (Art. 12/1). For health data, these measures are in concrete terms:
- Privacy notice: At hiring, give the worker a notice explaining for what purpose and by whom their health data is processed.
- Physical storage: Paper files are kept in a locked cabinet under the physician's control; it is clear who holds the key.
- Digital storage: Health records are kept in a system that only authorised users can open; they are not placed in a shared folder.
- Authorisation matrix: Who can access which record is written down and updated when staff change.
- Transmission: Test results and reports are not sent via messaging apps or unencrypted email; reports are not photographed and shared.
- Human resources file: The personnel file contains only the fitness outcome; medical attachments stay in the physician's file.
- OSGB contract: Where health data will be stored, confidentiality obligations and the method of handover at the end of the contract are written into the contract. The data controller is jointly responsible for the measures together with the person processing data on its behalf (Art. 12/2).
- Breach plan: If data is obtained by others unlawfully, the data controller notifies the data subject and the Board as soon as possible (Art. 12/5). Who will notify should be decided in advance.
A gap that is easily overlooked in many workplaces, including businesses in Bursa and neighbouring provinces, is test results and hospital reports being attached to human resources personnel files. Moving these documents to the physician's file is an easy fix under both Law 6331 and KVKK. For the general organisation of records, see our article on OHS file contents.
The Bursa Sistemer OSGB approach
In our workplace physician and health surveillance services, we put into practice the principle of confidentiality that is part of our quality policy as follows: examination results stay in the physician's file, and the employer is notified in writing only of the fitness decision and, where needed, any work restriction. We plan tests with authorised healthcare providers, and results reach the workplace only after the physician's assessment. You can use our OHS calendar tool to track periodic examination dates.
Frequently Asked Questions
Can the employer ask for a worker's test results?
No. The employer knows the fitness-for-work outcome and any work restriction; test values, diagnosis and medication information stay in the physician's file. Health information is confidential under Art. 15/5 of Law No. 6331.
Is explicit KVKK consent from the worker needed for health surveillance?
Pre-employment and periodic examinations are legal obligations imposed by OHS legislation; KVKK Art. 6/3-f permits processing that is mandatory for these obligations without requiring explicit consent. The duty to inform and the adequate measures apply in every case.
How many years are health files kept?
Personal health files are kept for at least 15 years from the date the worker leaves employment. For records of exposure to carcinogenic or mutagenic substances and asbestos, the period is at least 40 years after exposure ends.
Can a worker who leaves get a copy of their health file?
Under KVKK Art. 11, the worker can request information about data relating to them. If they start work at a new workplace, the new employer requests the file in writing; the previous employer sends a certified copy within one month.
A physician assigned for the time your hazard class requires: pre-employment and periodic examinations, fitness-for-work reports and health surveillance.
Bursa SİSTEMER OSGB Technical Team — written from the field experience of our OHS specialists and workplace physicians. Legal information is valid as of the publication/update date; contact us for an assessment specific to your business.