Recent Development
The Turkish Personal Data Protection Board (“Board”) has issued a principle decision on the monitoring of communication channels used for work purposes, particularly corporate email accounts that employers assign to employees.
The principle decision of the Board dated 16 September 2026 and numbered 2026/2035 containing assessment of how employers may review and monitor the communication channels and devices they provide to employees (“Principle Decision”), was published in the Official Gazette dated 8 October 2026 and numbered 33394.
The Board sets out a detailed analysis, within the scope of the Law No. 6698 on the Protection of Personal Data (“Law”), of procedures and principles governing employee monitoring activities, addressing in particular their legal nature and legal basis, transparency and proportionality requirements, the circumstances under which content review may be conducted, and the handling of monitoring processes following the termination of the employment relationship.
The Principle Decision is available here (in Turkish).
Details of the Principle Decision
| Scope | The Board stated that a corporate email account assigned to an employee is more than merely a means of communication; it is also a source of data containing the employee’s professional and, at times, personal network of relationships, work patterns, and correspondence. Accordingly, the monitoring of such accounts by the employer constitutes a personal data processing activity that requires a balance to be ensured between the employer’s managerial authority and the employee’s right to request the protection of personal data and freedom of communication, as guaranteed under Articles 20 and 22 of the Constitution. In this respect, the Principle Decision does not limit monitoring solely to corporate email accounts, but also covers other communication channels used for the conduct of business. Accordingly, depending on the circumstances of the specific case, channels such as (i) internal messaging applications, (ii) corporate instant messaging accounts, (iii) customer relationship systems, (iv) request management systems, and (v) chat and recording features on meeting platforms may also be subject to monitoring. For applications that are also suitable for personal use, whether the account was provided by the employer for business purposes, whether it is used through the employee’s personal account, and the employee’s reasonable expectation of privacy must be assessed separately. The Board stated that even the review of traffic/log records alone, without any access to content, constitutes personal data processing. Therefore, the Board considered that the monitoring of both traffic data and content must be carried out in accordance with the general principles, conditions for processing, and obligations regarding transparency and data security under the Law, and that the fact that the communication tools belong to the employer does not grant an unrestricted monitoring authority. |
| Personal Use and Personal Accounts | According to the Principle Decision, rules governing the personal use of communication tools must be clearly and comprehensibly defined and communicated to employees. However, even where personal use is prohibited, this does not eliminate the requirement that monitoring be conducted in a proportionate manner. According to the Board, where a breach of the prohibition on personal use can be identified from information other than the content of communications, accessing the content of correspondence is not considered necessary or proportionate. Where personal use is permitted, if business-related and personal correspondence can be distinguished, monitoring should be limited to business-related correspondence; where such a distinction cannot be made, the scope of the monitoring authority must be interpreted more narrowly. The Board stated that the employer’s technical ability to access a particular device, session, network, or corporate system does not mean that it may freely access the content of correspondence contained in an employee’s personal email account, personal instant messaging application, social media account, or similar private communication channels, and emphasized that technical capability to access such content must be distinguished from the legal authority to do so. |
| Informing Employees in Advance and Fulfilment of the Notice Requirement | The Principle Decision stated that, for monitoring to be lawful, employees must be clearly informed in advance of such monitoring. In this respect, the employer’s monitoring authority is subject, in line with the principles established in the case law of the Constitutional Court and the European Court of Human Rights, to the criteria of (i) informing employees in advance, (ii) legitimate purpose, (iii) purpose limitation, and (iv) proportionality and the prioritization of less intrusive methods. The Board further considered that requirement to inform employees in advance recognized by the Constitutional Court and the notice requirement under Article 10 of the Law are distinct concepts, but that a duly provided privacy notice may also satisfy the requirement to inform employees in advance. The Board stated, however, that general statements such as “corporate email accounts may be monitored” are not sufficient. In this context, the privacy notice to be provided by the employer must clearly, comprehensibly and specifically set out (i) the legal basis for the monitoring, (ii) its purpose and scope, (iii) whether only traffic/log records or also the content of communications will be reviewed, (iv) the circumstances under which content may be accessed, (v) the data retention period, and (vi) employees’ rights under the Law. |
| Legal Basis and Limits of Monitoring | The Board stated that, depending on the circumstances of the specific case, monitoring activities may be carried out on the basis that the processing of personal data is necessary (i) for the data controller to comply with its legal obligations, (ii) for the establishment, exercise or protection of a right, or (iii) for the legitimate interests of the data controller, provided that such processing does not prejudice the fundamental rights and freedoms of the data subject. The Board further noted that explicit consent should not be regarded as the primary legal basis for email monitoring in all cases and that, where reliance is placed on consent, whether such consent has been freely given must be assessed on a case-by-case basis in light of the specific circumstances. The Board stated that even where a valid legal basis exists, this does not grant the employer an unrestricted authority to monitor, and monitoring activities must be carried out in compliance with the general principles set out in Article 4 of the Law. The Board further considered that a graduated approach is fundamental, and that a more intrusive method may not be used where the legitimate purpose can be achieved through a less intrusive method. Accordingly, the Board stated that access to content is permissible only in exceptional circumstances where traffic data is insufficient and access to content is necessary, provided that such access is based on a specific suspicion and limited to the relevant allegation. It also emphasized that continuous surveillance and general content reviews of undefined scope should be avoided. In addition, the Board stated that it must be taken into account that the personal data processed in the course of monitoring may include special categories of personal data and that the communications subject to monitoring may contain personal data relating to the other parties to the communications or other third parties. |
| Access to and Retention of Data | The Board stated that access to data obtained through monitoring must (i) be restricted to a limited number of personnel authorized under their job descriptions, (ii) be logged, and (iii) be subject to confidentiality obligations applicable to the relevant personnel. In this context, the data may be retained only for as long as necessary for the purposes of monitoring. |
| Handling of Corporate Accounts Following Termination of Employment | The Board stated that, following the termination of the employment relationship, the legal basis for personal data processing activities relating to the corporate email account must be assessed separately. Accordingly, as a general rule, the employer is required to disable the former employee’s account for active use and new access, to prevent incoming messages from being viewed by unauthorized persons, and to destroy personal data for which there is no longer a legal basis for processing. However, the Board stated that, for the purposes of ensuring business continuity, avoiding disruption to corporate communications, exercising the right of defense in legal disputes, or complying with statutory obligations; practices such as email forwarding, automatic replies, archiving or retention may be taken into account depending on the circumstances of the specific case. Such practices must be implemented on a limited and time-bound basis, with access rights clearly defined and access duly logged. Accordingly, it is important for employers to align their processes for handling the accounts of former employees with their retention and destruction policies, particularly with respect to account closure, the scope of any forwarding or archiving practices, and the destruction of data. |
Conclusion
The Principle Decision consolidates the Board’s approach to the monitoring and review of communication channels and devices provided to employees within a single framework and clarifies the procedures and principles that employers must take into account when carrying out monitoring activities. The Principle Decision requires employers to review their existing monitoring practices.
The Principle Decision does not provide for a specific compliance period and states that, where non-compliance with the applicable obligations is identified, administrative action will be taken against the relevant data controllers pursuant to Article 18 of the Law, considering the circumstances of the specific case. In this context, employers must review their policies and notices concerning employee monitoring and the use of workplace communication tools in line with the Principle Decision. On the other hand, the Principle Decision addresses the monitoring and review of communication channels and devices provided to employees solely from the perspective of personal data protection legislation. It is important for employers to adopt a holistic approach to monitoring and review activities by also taking into account the relevant provisions of labor law and criminal law.
