Why Should Turkey Switch to a Digital ID Wallet?

In Turkey, we often share more personal information than necessary to prove our identity. A hospital, bank, hotel, employer, or online retailer may ask us for our Turkish ID number, date of birth, ID card serial number, or a copy of the document. The same information is stored repeatedly in different databases.

Yet a service usually doesn’t need our entire ID card. The institution simply wants to verify that the person is real, is of a certain age, has a valid diploma, or is authorized to use a service.

Turkey does not need a new ID number. It needs a citizen-controlled layer of security that can verify identity without having to provide the ID number to every institution.

What is a digital identity wallet?

The “digital wallet” referred to here is not a payment or cryptocurrency wallet. It is a digital identity wallet that stores identity attributes verified by the government and authorized institutions, all under the citizen’s control.

The wallet is not merely a way to display a photo of your ID card on your phone. Its primary function is to provide the minimum information required for a specific transaction in a digitally signed and verifiable format.

For example, the following proof can be shared without an e-commerce site needing to know our date of birth:

{
  "claim": "age_over_18",
  "value": true,
  "issuer": "yetkili-kamu-kurumu",
  "valid_until": "2026-10-17T20:00:00+03:00"
}

The site can verify that the age requirement is met without learning the person’s name, Turkish ID number, or full date of birth.

Why is the current model problematic?

The current identity verification model largely relies on data duplication:

Kurum kimlik bilgisi ister
        ↓
Vatandaş form doldurur veya belge görüntüsü yükler
        ↓
Kurum bilgileri kendi sisteminde saklar
        ↓
Aynı kimlik verisinin çok sayıda kopyası oluşur

Even if the central population registry is strongly secured, copying the data to numerous points—such as hospital automation systems, call centers, email, support tickets, analytics platforms, and test environments—expands the attack surface.

The impact of a data breach may not be limited to a single organization. A common and persistent identifier, such as a Turkish ID number, makes it easy to link different datasets to the same individual.

Why is Turkey ready for this transformation?

Turkey is not starting from scratch when it comes to digital identity. By the end of 2025, the number of e-Government Portal users had exceeded 68 million. The Turkish ID card serves the purpose of electronic identity verification; users can log in to e-Government using methods such as the electronic ID card, electronic signature, mobile signature, and online banking.

In addition, there are the Electronic Identity Verification System, the Identity Sharing System, national public key infrastructures, and TÜBİTAK BİLGEM’s digital identity initiatives. What is missing is not a new population database; rather, it is the transformation of existing trust sources into a standardized and interoperable presentation layer controlled by the citizen.

Proving attributes instead of sharing identity information

The digital identity wallet reframes the question:

"Bu kişinin T.C. kimlik numarası nedir?"

Instead:

"Bu kişi doğrulanmış gerçek bir kişi mi?"
"18 yaşından büyük mü?"
"Ehliyeti geçerli mi?"
"Diploması doğrulanmış mı?"
"Sağlık güvencesi aktif mi?"

The institution obtains only the information necessary to fulfill its duty; it does not collect any personal data beyond that. This approach embeds the principles of purpose limitation, data minimization, and data necessity—as outlined in the KVKK and GDPR—into the technical design.

Key benefits for Turkey

1. Reduces the unnecessary circulation of the Turkish ID number

The Turkish ID number is no longer the common customer identifier for every organization. In transactions not explicitly required by law, a verified attribute or an organization-specific alias can be used.

2. Reduces the culture of document photocopying

Instead of images of diplomas, ID cards, residence permits, or authorization certificates, verifiable information bearing the digital signature of the issuing institution is provided.

3. Makes forgery more difficult

PDFs or screenshots can be visually altered. In verifiable identity information, however, the content is protected by the issuer’s digital signature; altered data fails verification.

4. Provides transparency to the user

Citizens can see which institution is requesting what information and for what purpose before the transaction takes place. After sharing, they can receive a digital receipt and review past accesses.

5. Reduces the data burden on institutions

If organizations do not store raw identity data they do not need, the impact of data breaches, storage costs, and compliance burdens are reduced.

6. Enables cross-border interoperability

If Turkey establishes a system compatible with open standards such as W3C Verifiable Credentials, OpenID4VC, and ISO mdoc, certain forms of proof—such as diplomas, professional certifications, or travel-related documents—can interoperate more easily with international systems.

Why isn’t a static QR code the solution?

Issuing every citizen a static QR code or alphanumeric code may seem practical at first glance. However, if this code is reused across all institutions, it will eventually become a second form of identification:

• It can be copied or screenshotted.
• It can be used to merge records from different institutions.
• If stolen, it can be misused for a long time.
• It could make it easier to track a person’s behavior across institutions.

The correct model is a short-lived, single-use, dynamic QR code tied to a specific institution and a specific purpose. The QR code does not carry identity information; it carries a signed verification request or a transaction address.

Institution-specific virtual ID

If the same person needs to be recognized during subsequent visits, a different alias identifier can be assigned to each organization:

Hastane A → HSP-A-72F91...
Banka B   → BNK-B-48D20...
Site C    → WEB-C-19A73...

This way, an identifier leaked from one institution cannot be used directly as a search key in another institution’s database. In sectors requiring record continuity, such as healthcare, the balance between institution-based and sector-based identifiers can be further defined.

Risk of Centralized Surveillance

If a digital identity wallet is poorly designed, it can become a centralized surveillance infrastructure rather than strengthening privacy. If the government is required to view every presentation of an identity online, it can track which hospital, bank, or service a citizen accesses through a single central hub.

For this reason, low-risk verifications should be performed directly using the signed information in the wallet. The issuing institution should not be required to be notified every time the wallet is used. A centralized service can be used for high-risk transactions that legally require online verification.

Risk of Digital Exclusion

Citizens who do not own a smartphone, as well as those with disabilities, the elderly, or those who have difficulty using devices, must not be excluded from services. Physical ID cards, public kiosks, in-person verification, parental/guardian authorization, and accessibility options must be preserved.

The digital wallet should not be the sole mandatory channel but rather a privacy-protected digital complement to physical identification.

Essential Principles for Success

• Voluntary participation and physical alternatives,
• Minimal data sharing,
• Transparent disclosure of purpose and recipients to the user,
• Organization-specific pseudonymous identifiers,
• Open and international standards,
• Hardware-backed key security,
• Independent security and privacy audits,
• Citizens’ ability to view their access history,
• Easy revocation and secure recovery,
• An interoperable architecture not dependent on a single manufacturer.

Data minimization in the working example

The synthetic-data demo built to explore this approach now includes an HTTPS institution portal, a native iPhone wallet and a separate SoftHSM signing service. Dedicated journeys cover age verification, hospital preregistration, municipal address sharing, bank applications, student status, deliveries, driving eligibility and household summaries. None creates a real bank account or an official service application.

Institutions are no longer limited to hard-coded names. An institution such as “Eren Baş University” can be registered through the application with a separate account and request templates defining its fields and purposes. Both the institution and its template require administrator approval before information requests can be sent. Approval for this synthetic demo does not establish the legal identity of a real university.

Issuer signatures are now generated using ES256 in SoftHSM, while the iPhone uses its own distinct device key. This separates the questions of why an institution needs information, what the user approved and which key signed the result. SoftHSM remains a software laboratory component; hardware-backed issuer keys, strong enrollment, standard protocols and independent assessment remain necessary production work.

Conclusion

Turkey’s transition to a digital identity wallet should not simply mean copying the ID card onto a phone. The real transformation lies in moving from the sharing of raw personal data to verifiable data sharing with minimal attributes.

As citizens gain more control, institutions store less data, forgery becomes more difficult, and identity verification processes become standardized. Turkey’s robust e-Government, electronic identity, and PKI infrastructure serve as a crucial starting point for this transformation.

Next article in the series: How should Turkey’s digital identity wallet be designed?

Official sources

• e-Government Portal Statistics, 2025
• NVI — Turkish Republic ID Card Transactions
• NVI — Identity Sharing System
• TÜBİTAK BİLGEM — SSI Turkey
• European Digital Identity Wallet Architecture and Reference Framework

This article is intended for general technical and legal evaluation; sector-specific regulations should be reviewed separately for specific applications.