Time & Attendance (PDKS): Choose your method, keep records ready for the attendance ledger

Who is it for, and what problem does it solve?

The Time & Attendance (PDKS) module is for businesses that keep clock-in and clock-out times on a sign-in sheet, in Excel or only on a device's screen, and carry these records into the attendance ledger by hand at month end. In this setup, problems usually appear not when the record is made but afterwards:

• Forgotten clock-outs and wrong records are corrected in bulk at month end, without explanation.
• Manual errors creep in when records are carried into the attendance ledger and payroll.
• Late arrivals, early departures and days without records are not reported regularly.
• Workplaces that use biometric devices face the need for an assessment under KVKK (Türkiye's Personal Data Protection Law No. 6698).

The module keeps every record traceable from the moment it is created until it enters the attendance ledger. In the Time & Attendance category, it works together with leave and the attendance ledger.

What does Time & Attendance (PDKS) do?

The module collects clock-in and clock-out records created by different methods into a single record structure and turns them into attendance information. The functions available today are:

• QR code clock-in: HR defines coordinates and a radius for each location (100 metres by default, adjustable per location), prints the location's fixed QR code and posts it at the entrance. The employee scans the code with their phone, signs in with their own account and allows location access; if the location is within the radius and accurate enough, the record is stored together with the location it was made from. “Regenerate” issues a new code and invalidates the old printout. There is no clock-in from a computer or without scanning the QR code.
• Self-service view: the employee sees the day's records, working time and lateness on the self-service screen; records are made with QR.
• Import from device files: time records produced by existing devices such as card readers are imported as a CSV or xlsx file. The file is previewed first; duplicate rows are written once, and for readings without a direction, clock-in or clock-out is determined from the previous record. There is no direct connection to device manufacturers.
• Corrections with a reason: HR adds a missing record by hand and writes a reason; these records are labelled “Correction” and written to the audit log. Records for employees working off-site or not allowing location access are entered this way too. Records are not deleted but voided; manual records can be entered at most 93 days back, and no one except the company owner can enter a manual record on their own card.
• Work schedules: start and end times, rest breaks, tolerances for late arrival and early departure, and night shifts; a company default schedule and employee-specific assignments. A schedule with no record expected can also be defined. Every employee has one schedule; rotating plans and shifts that vary by day are coming soon with Shift Scheduling.
• Daily and monthly views: the daily table on the employee card shows clock-in, clock-out, working, break, late arrival, early departure and night times; the monthly attendance ledger shows all staff. Managers see only their own team.
• Link to the attendance ledger: daily working time and attendance status are calculated automatically in the Attendance Ledger (Puantaj); approved leave from Leave Management appears in the same table.

For QR records, the time of the record is the server time; for device files the time comes from the file, and for manual records from the time entered. For QR records, a second record within 60 seconds is not accepted. The location check prevents records from outside the location with a shared code; against a spoofed browser location it is a deterrent, not proof. HR can review doubtful records using the distance and accuracy values. Employee correction requests with manager approval are not available yet; they are coming soon. Today, HR corrects missing or wrong records. Shift scheduling, overtime calculation and compensatory time, field worker tracking and the mobile app are also among the coming-soon modules; they are described in the Time & Attendance and Platform & Integrations categories.

Which clock-in method suits whom?

There is no single right method; the choice depends on the workplace's structure, the number of employees, existing hardware and the personal data assessment. The table below compares the methods neutrally:

How does it work?

Setting up PDKS and day-to-day operation come down to five steps:

1. Define locations. Create QR locations with coordinates and a radius, then print the codes and post them at the entrances.
2. Enter working hours. Define the default schedule and, if needed, employee-specific schedules with rest breaks and tolerances.
3. Records are created. Employees record with the QR code at the location; device records are imported by file.
4. Gaps are fixed. For days flagged with a missing-record warning in the attendance ledger, HR completes the day with a correction record and a reason; wrong records are voided.
5. Attendance flows into the ledger. Daily working time and the day code are calculated automatically in the attendance ledger; later corrections are also reflected there immediately. Locking the attendance ledger period is coming soon.

How does data flow between PDKS, the attendance ledger and payroll?

Today, a clock-in record turns into attendance information in two stages: PDKS records the time, and the attendance ledger links that day to a day code such as worked, on leave or absent; monthly totals are downloaded from the attendance ledger as a CSV file. The payroll calculation is not fed by the attendance ledger at present: the day count is 30 in a full month and is calculated from the dates when an employee joins or leaves during the month. Automatic carrying of absent and unpaid-leave days into payroll as missing days, and the attendance ledger period lock, are coming soon. What matters on the PDKS side is that every record carries its source (QR, device, manual correction) and that voided records remain in the audit log. The flow is described in detail on the Attendance Ledger (Puantaj) page and the pay calculation on the Payroll (Türkiye) page. Plans are based on the number of active employees; current prices are on the Pricing page.

Biometric PDKS and KVKK: what should employers know?

Biometric data such as fingerprints and facial recognition are special categories of personal data under KVKK and are subject to stricter processing conditions. The Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) adopted principle decision No. 2026/921 dated 29.04.2026 on processing biometric data for working-time tracking; the text of the decision was published in the Official Gazette. According to the Personal Data Protection Authority's public announcement:

• Processing for this purpose is assessed against the principles of necessity, proportionality and data minimisation; processing that does not meet these principles is considered unlawful even if the data subject has given explicit consent.
• Because of the power imbalance in the employment relationship, explicit consent is, as a rule, not regarded as a sufficient legal basis.
• The announcement mentions alternative methods such as encrypted card or PIN-based systems, traditional signature and paper-based attendance sheets, RFID/NFC identity cards and manual entry under a supervisor's oversight.
• As a result, under the decision, processing biometric data for working-time tracking does not meet the proportionality principle even when valid explicit consent has been obtained.

The decision directly concerns employers that use biometric systems for working-time tracking: explicit consent does not make this processing proportionate. Before deciding how to change your current system, read the announcement and the decision text in the Official Gazette, and consult your legal adviser. This section is not legal advice.

The Sora İK PDKS module does not collect biometric data; it stores only the clock-in or clock-out time, the direction, the source of the record (QR, device file, manual correction), the QR location, the distance to the location and the location accuracy (in metres), the device name, the note and the user who created the record. Raw location, IP address and browser information are not recorded. Importing time records from a biometric device by file does not remove the need to assess separately the processing done on the device itself. Publishing company-wide documents such as privacy notices to employees is coming soon to the Document & Contract Management module; the personal data inventory will also be part of the coming-soon KVKK Compliance Management module. For how data is hosted and protected, see the Security and data protection page.