The Turkish Personal Data Protection Board Issues a Principle Decision on Monitoring Employees’ Communication Channels
The Turkish Personal Data Protection Board’s (the “Board”) Principle Decision dated 16 September 2026 and numbered 2026/2035 (the “Principle Decision”) was published in the Official Gazette dated 8 October 2026 and numbered 33394. The Principle Decision sets out key procedures and principles governing employers’ monitoring of corporate email accounts and other communication channels allocated to employees.
In the Principle Decision, the Board emphasises the need to strike a balance between the employer’s managerial prerogative and the employee’s freedom of communication and right to the protection of personal data. Accordingly, ownership of communication tools does not confer an unrestricted right to monitor their use. Monitoring may only be conducted in accordance with the requirements of prior notification, a legal basis, necessity and proportionality.
The key requirements that employers must observe when exercising their monitoring powers under the Principle Decision are outlined below.
The Scope of Monitoring Extends Beyond Corporate Email Accounts.
The Principle Decision covers not only corporate email accounts but also internal messaging applications, corporate instant messaging accounts, customer relationship and request management systems, and the chat and recording functions of meeting platforms. Accordingly, monitoring must take into account the purpose for which the account was allocated, whether it is used for personal purposes, and the employee’s reasonable expectation of privacy.
The Board also states that examining traffic data or logs alone, without accessing the content of communications, constitutes personal data processing. Monitoring traffic data is therefore also subject to the general principles, conditions for processing, obligation to inform and data security obligations under the Law.
The Distinction Between Business and Personal Use Will Determine the Limits of Monitoring.
Under the Principle Decision, employers may, within the scope of their managerial prerogative, prohibit or regulate the personal use of workplace communication tools. However, these rules must be clearly communicated to employees. A prohibition on personal use does not justify continuous surveillance. Where a breach occurs, accessing the content of communications will not be considered proportionate if non-content data is sufficient. Where personal use is permitted, monitoring must be limited to business communications, and personal correspondence must be excluded. Where business and personal communications cannot be separated, the employer’s monitoring powers must be interpreted more narrowly.
Technical Ability to Access Must Be Distinguished from Legal Authority to Access.
The Principle Decision distinguishes between an employer’s technical privileges over a device, session, network or corporate system and its legal authority to examine communications accessible through those systems. Accordingly, holding technical privileges does not mean that an employer may freely access an employee’s personal email account, personal messaging application or social media inbox. This requires access permissions to be defined with due regard to legal limits, particularly where personal accounts are also used on corporate devices.
Employees Must Be Notified in Advance and Provided with Specific Information.
The Board emphasises that the prior notification requirement established in the Constitutional Court’s case law differs from the obligation to inform under Article 10 of the Law. However, comprehensive information that contains the elements required by the Law and explains the purpose, scope and methods of monitoring may also satisfy the prior notification requirement. The information provided must specifically identify the legal basis, purpose and scope of personal data processing, the monitoring method (logs or content), the circumstances in which access may occur, retention periods and employees’ rights. General and abstract statements, such as an indication that an email account may be monitored, are insufficient. Covert and indiscriminate continuous monitoring is also unlawful.
Explicit Consent Should Not Be Treated as the Primary Legal Basis for Monitoring.
The Principle Decision states that, due to the dependency and imbalance of power inherent in the employment relationship, explicit consent should generally not be treated as the primary legal basis for email monitoring. Where consent is relied upon, whether it was freely given will be assessed on a case-by-case basis. Monitoring may be based on other conditions for processing, such as compliance with a legal obligation, the establishment or protection of a right, or legitimate interests. However, the existence of a valid condition for processing does not grant the employer unrestricted powers. Monitoring must, in all circumstances, comply with the general principles of the Law and be relevant, limited and proportionate to its purpose.
Content Monitoring May Be Used Only in Exceptional Cases Where a Graduated Approach Is Insufficient.
In the Principle Decision, the Board adopts the principle of a “graduated approach to monitoring”. Accordingly, more intrusive monitoring methods may not be used where the legitimate purpose can be achieved through less intrusive means. Content must not be examined where traffic data is sufficient. Content monitoring may only be conducted where it is necessary and exceptional, and must be limited to the allegation in respect of which there are specific grounds for suspicion. General and continuous examination of content is considered unlawful.
Furthermore, where misuse can be prevented through technical measures such as filtering or blocking, this does not confer a general right to monitor on the employer.
Special Categories of Personal Data and Third-Party Data Must Be Taken into Account.
Given that monitored communications or attachments may contain special categories of personal data or personal data relating to recipients or third parties, the conditions under Article 6 of the Law must be observed, and the impact of monitoring on those individuals must be assessed. Access to the data obtained must be restricted to a limited number of designated personnel. Access logs must be maintained, and compliance with confidentiality obligations must be ensured. Data must be retained only for as long as required for the purpose of processing.
Access and Retention Following Termination of Employment Must Be Separately Assessed.
The Principle Decision emphasises that personal data processing activities involving a corporate email account must be reassessed when the employment relationship ends. As a rule, the account must be disabled for active use, unauthorised persons must be prevented from viewing incoming messages, and data for which there is no longer a legal basis for processing must be destroyed. However, arrangements such as email forwarding, automatic replies or archiving may continue for business continuity, the exercise of the right of defence in legal disputes, or compliance with statutory obligations. Such arrangements must be limited in scope and duration, subject to defined access permissions, and logged.
Conclusion
The Principle Decision requires corporate communications monitoring to be conducted in accordance with employees’ fundamental rights and data protection principles. Employers must therefore update their policies and privacy notices to clearly specify the purpose and methods of monitoring and the persons authorised to conduct it. Less intrusive methods must be assessed before the content of communications is examined, and access permissions must be restricted. Account-related processes for departing employees, including access, forwarding and retention, must also be planned. Compliance efforts must cover both technical access permissions and actual practices. Failure to comply with the obligations set out in the Principle Decision may result in administrative sanctions against data controllers under Article 18 of the Law.
AUTHORS
Nuri Melih İnce
Sena Nur Temur
