On 8 October 2026, the Turkish Personal Data Protection Authority\u2019s Principle Decision No. 2026\/2035, dated 16 September 2026, was published in the Official Gazette. The Decision sets out the key principles to be observed by employers when monitoring corporate e-mail accounts and other communication channels used by employees for the performance of work, taking into account the balance between employers\u2019 management and supervisory powers and employees\u2019 rights to the protection of personal data, privacy and freedom of communication.<\/p>\n
In particular, the Decision clarifies that even the examination of traffic or log records, without accessing the content of communications, constitutes personal data processing under Turkish Personal Data Protection Law No.\u00a06698 (DPL). Accordingly, employers must rely on an appropriate legal basis, provide employees with adequate prior information, pursue a legitimate purpose and ensure that monitoring is necessary and proportionate. Access to the content of communications should, in principle, be limited to cases where less intrusive methods are insufficient.<\/p>\n
The Decision provides important guidance for employers monitoring corporate communication channels for purposes including information security, regulatory compliance, internal audits, workplace investigations and disputes or legal proceedings arising between employers and employees. It also addresses the management of corporate e-mail accounts following termination of the employment relationship.<\/p>\n
Failure to comply with the principles set out in the Decision would expose employers to administrative fines under Article\u00a018 of the DPL, depending on the circumstances of the specific case.<\/p>\n
The key principles established by the Decision are examined in further detail below.<\/p>\n
The Decision clarifies that communication channels subject to monitoring are not limited to corporate e-mail accounts. They may also include other communication tools used for the performance of work, such as internal messaging applications, corporate instant messaging accounts, customer relationship management or request management systems, and the chat and recording features of meeting platforms.<\/p>\n
The mere fact that such communication tools are owned by the employer, used in the workplace or technically accessible to the employer does not, in itself, grant the employer an unrestricted right to monitor or examine them.<\/p>\n
When determining the permissible scope of monitoring, a distinction should be made between the use of communication tools for business and personal purposes. Employers may, within the scope of their management rights, prohibit or impose conditions on the personal use of corporate communication tools. However, employees must be informed of such rules in advance in a clear and understandable manner.<\/p>\n
Even where personal use is prohibited, access to the content of communications will not necessarily be justified. For example, where a breach of the prohibition on personal use can be established through traffic or log records, accessing communication content may constitute a disproportionate interference. Where personal use is permitted, monitoring should, to the extent possible, be limited to business-related communications and employees\u2019 private correspondence should be excluded from its scope.<\/p>\n
As noted above, even the monitoring of corporate email accounts solely through traffic or log records, without accessing the content of communications, constitutes personal data processing. Accordingly, regardless of the scope and method of monitoring, employers must comply with the general principles set out in Article\u00a04, the legal grounds for processing personal data under Articles\u00a05 and 6, and the data security obligations under Article\u00a012 of the DPL.<\/p>\n
The Decision further emphasises that, due to the imbalance of power inherent in the employment relationship, employees\u2019 explicit consent should generally not be relied upon as the primary legal basis for monitoring activities. Other legal grounds, such as compliance with a legal obligation, the establishment, exercise or protection of a right, and the legitimate interests of the data controller, may be considered depending on the circumstances of each case.<\/p>\n
Nevertheless, the existence of an appropriate legal basis for processing is not sufficient in itself, as monitoring activities must also be relevant to their intended purpose, necessary and proportionate.<\/p>\n
The Decision places particular emphasis on informing employees in relation to monitoring activities. A general notice merely stating that corporate e-mail accounts may be monitored by the employer is not sufficient. Where employees are not adequately informed of the scope of monitoring, they may have a reasonable expectation of privacy in relation to their communications.<\/p>\n
The Decision draws a clear distinction between the prior notice requirement established under the case law of the Constitutional Court and the information obligation under the DPL. Not every form of advance notification to employees will qualify as a compliant privacy notice within the meaning of the DPL. However, a duly provided privacy notice that meets the specific requirements of the DPL and that contains clear information on the monitoring activity may simultaneously satisfy the prior notice condition set by the Constitutional Court.<\/p>\n
Accordingly, employers must ensure that employees are provided with a comprehensive privacy notice that goes beyond abstract and general statements and includes in particular, in a clear, understandable and specific manner: the legal basis for the processing activity; the purpose and scope of monitoring; whether monitoring will be carried out through the examination of traffic or log records or through access to communication content; the circumstances in which content may be accessed; the applicable retention periods; and employees\u2019 rights under Article\u00a011 of the DPL.<\/p>\n
Under the Decision, employers should prioritise less intrusive methods when carrying out monitoring activities. Access to communication content should therefore only be considered where the examination of traffic or log records is insufficient and access to the content is necessary for the intended purpose.<\/p>\n
Any monitoring of communication content must be based on specific grounds and limited to the matter under investigation; general and continuous monitoring should be avoided, and content-based monitoring should not be resorted to where misuse of communication tools can be prevented through technical measures such as filtering or blocking. Where access to content is necessary, due consideration must be given to the protection of any sensitive personal data and personal data belonging to third parties contained in the communications.<\/p>\n
It is unlawful to monitor employees without their knowledge or to indiscriminately record all communications. Monitoring activities should therefore remain within the purposes, scope and methods communicated to employees in advance.<\/p>\n
Employers should also ensure that access to personal data obtained through monitoring is restricted to authorised personnel, access logs are maintained, and relevant personnel are subject to confidentiality obligations.<\/p>\n
Following termination of the employment relationship, corporate e-mail accounts allocated to employees should be deactivated and protected against unauthorised access, and personal data for which there is no legal basis for continued processing should be destroyed.<\/p>\n
However, where necessary and proportionate, limited-term e-mail forwarding, automatic replies, archiving and retention measures may be implemented for purposes such as ensuring business continuity, protecting rights in legal disputes or complying with statutory obligations. In such cases, access rights should be appropriately restricted and records of the relevant activities maintained.<\/p>\n
In light of the Decision, employers should consider reviewing the following:<\/p>\n
The review of corporate communication channels and company devices constitutes a key method for gathering information on alleged misconduct in the course of internal investigations. Such reviews may be conducted during the employment relationship or following its termination, and the data obtained frequently serves as supporting evidence in subsequent legal processes, including the termination of employment contracts, disciplinary proceedings and criminal complaints.<\/p>\n
While the employer\u2019s legitimate interests, the establishment or defence of a right, or compliance with legal obligations may each constitute a legal basis for processing personal data under the DPL during such investigations, the requirements set out in the Decision, including the principles of proportionality, prior notice and graduated access, remain fully applicable. Accordingly, employers conducting internal investigations should ensure that their investigation procedures are aligned with the principles established by the Decision.<\/p>\n","protected":false},"excerpt":{"rendered":"
On 8 October 2026, the Turkish Personal Data Protection Authority\u2019s Principle Decision No. 2026\/2035, dated 16 September 2026, was published in the Official Gazette.<\/p>\n","protected":false},"author":3,"featured_media":158169,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[281],"tags":[],"class_list":["post-158150","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-publications"],"paksoy_ekip":[],"paksoy_dil":"en","paksoy_ceviriler":{"tr":158147,"en":158150},"acf":[],"yoast_head":"\n