The Turkish Personal Data Protection Board’s Principle Decision No. 2026/2035: Monitoring Employees’ Corporate Email and Communication Channels

Key considerations for employers in relation to compliance with the Turkish Personal Data Protection Law

Principle Decision No. 2026/2035, adopted by the Turkish Personal Data Protection Board on 16 September 2026, was published in the Official Gazette dated 8 October 2026 and numbered 33394. The Decision draws attention to important principles concerning personal data processing activities carried out when employers monitor corporate email accounts allocated to employees and other communication channels used for work-related purposes.

Operations such as monitoring corporate email and messaging tools, reviewing traffic and log records, applying filters, conducting routine checks, or accessing the contents of correspondence may constitute personal data processing activities, depending on the circumstances. Accordingly, employers should address monitoring processes not solely by reference to technical capabilities or the employer’s property rights, but also within the framework of personal data protection principles and employees’ fundamental rights.

The employer’s monitoring authority is not unlimited
The fact that an employer has allocated a corporate email account or communication tool to an employee does not mean that the employer may access all data held in or generated through such accounts and tools without limitation in all circumstances. Monitoring activities must be based on a specific, clear and legitimate purpose and must be carried out in a manner that is connected with that purpose, limited and proportionate. The technical ability to access a system does not, in itself, establish a legal entitlement to access the data.

Employees must be informed in advance and in clear terms
It is important that employees are informed in advance, clearly, comprehensibly and specifically about the purposes, methods and scope of any monitoring of corporate communication tools. To the extent applicable, privacy notices should explain the purposes and legal grounds for processing, the scope and method of monitoring, the circumstances in which the contents of correspondence may be accessed, the data retention period, and employees’ rights under the Turkish Personal Data Protection Law (Law No. 6698, “KVKK”).

A general statement such as “corporate email accounts may be monitored by the employer” may not be sufficient to fulfil the information obligation, depending on the circumstances of the particular case. The notice should be drafted with sufficient clarity to enable employees to understand and anticipate the scope and limits of the monitoring.

Necessity and proportionality must be observed when reviewing content
Access to the contents of correspondence should not be designed as a routine and unlimited practice. As a rule, content monitoring should be based on a concrete suspicion or a legitimate purpose connected with a specific incident, and should be limited to that purpose. Where less intrusive methods capable of achieving the monitoring objective are available, those methods should first be considered.

For example, in certain circumstances, it may be sufficient to review specific traffic or log records, check access authorisations, or conduct a technical examination limited to a particular incident instead of accessing the entirety of the correspondence. The necessity and proportionality of the method to be used should be assessed in light of the specific circumstances of each case.

Access authorisations, records and confidentiality must be safeguarded
Access to data obtained from corporate email and other communication channels should be restricted to individuals who have been duly authorised and whose duties require such access. Maintaining access logs, establishing confidentiality obligations, and protecting data against unauthorised access are important elements of the monitoring process. Data obtained during monitoring should not be used for purposes other than those specified, or shared with persons who have no relevant need to know.

Separate assessment is also required after the employment relationship ends
An employee’s departure does not automatically render lawful all subsequent operations involving the employee’s corporate email account and the data contained in it. The closure of the account, retention of data, access to work-related correspondence, and retention periods should be separately assessed in accordance with the legal basis, necessity and proportionality principles.

Practices and documents that companies should review
Updating employee privacy notices alone may not be sufficient in light of the Principle Decision. Written policies and the actual access and monitoring practices within the company must be consistent with one another. In this context, it is recommended that the following documents and processes be reviewed:

• KVKK privacy notices and related information provided to employees;
• Corporate email, information security and IT use policies;
• Procedures and instructions governing employees’ use of electronic communication tools;
• Practices concerning the retention and review of log and traffic records and access authorisations;
• Conditions, approval mechanisms and record-keeping processes established for accessing the contents of corporate email correspondence;
• Processes for closing corporate accounts, retaining correspondence and terminating access when an employee leaves the company.

Conclusion
The Turkish Personal Data Protection Board’s Principle Decision No. 2026/2035 highlights the importance of purpose limitation, proportionality, prior information, restricted access authorisations and confidentiality when monitoring employees’ corporate communication tools. Employers should review their existing policies and procedures, privacy notices and actual monitoring practices together, and identify the compliance measures required.

To assess your company’s existing practices in light of the Principle Decision and identify the necessary compliance measures, you may contact the Compass consultants.

This article has been prepared for general informational purposes. A separate assessment may be required depending on the specific facts and the practices of the relevant organisation.