Recent Development

The Turkish Data Protection Board’s (“Board”) Principle Decision dated 16 September 2026 and numbered 2026/2035 (“Principle Decision”) was published in the Official Gazette dated 8 October 2026 and numbered 33394. The Principle Decision sets out the procedures and principles applicable to personal data processing activities carried out through the monitoring of communication channels used for work purposes, particularly corporate email accounts assigned to employees by their employers.

The Board emphasizes the need to maintain a balance between the employer’s managerial prerogative and the employee’s right to the protection of personal data and freedom of communication. In this respect, the Principle Decision sets out specific principles concerning the legal basis, prior notification of employees, the scope and method of monitoring, and account management following the termination of the employment relationship.

What Does the Decision Say?

The Board states that even the examination of traffic/log records without accessing the content of correspondence constitutes personal data processing. The fact that communication tools belong to the employer or are used in the workplace does not confer an unlimited monitoring power on the employer. Monitoring activities are subject to the general principles, legal grounds for processing, obligation to inform and data security obligations under the Personal Data Protection Law No. 6698 (“Law”).

The main principles highlighted in the Principle Decision are as follows:

• First, the scope of monitoring is not limited to corporate email accounts. Internal messaging applications, corporate instant messaging accounts, customer relationship or request management systems, and chat and recording areas on meeting platforms may also fall within this scope, depending on the circumstances of the case. For applications that can also be used for personal purposes, whether the account was assigned for work purposes, whether the application is used through a personal account, and the employee’s reasonable expectation of privacy must be considered separately. The employer’s technical ability to access such tools does not mean that it may freely access the employee’s private communication spaces.
• Second, employees must be notified of monitoring in advance, and the obligation to inform under Article 10 of the Law must be fulfilled. A general notification stating that corporate email accounts may be monitored is insufficient. The information provided must clearly and specifically address the legal ground, purpose, scope, whether traffic/log records or content will be examined, the circumstances in which content may be accessed, the retention period, and the data subject’s rights under Article 11 of the Law. Although prior notification under the Constitutional Court’s case law and the obligation to inform under the Law are not identical concepts, properly fulfilling the obligation to inform by addressing these elements may also satisfy the prior notification requirement.
• Third, due to the dependency and power imbalance inherent in the employment relationship, an employee’s explicit consent should not, as a rule, be treated as the primary legal basis for monitoring. Where explicit consent is relied upon, whether it was freely given must be assessed in the circumstances of the case. Where the relevant conditions are met, processing in the context of monitoring may rely on the grounds under Article 5(2) of the Law requiring processing to be necessary for compliance with a legal obligation, for the establishment, exercise or protection of a right, or for the data controller’s legitimate interests, provided that the data subject’s fundamental rights and freedoms are not harmed. The existence of these grounds does not confer an unlimited monitoring power on the employer.
• Fourth, a distinction must be drawn between work-related and personal use. Employers may prohibit or restrict personal use, but the rules must be clear, understandable and known to employees. Continuous and uninterrupted surveillance is not considered proportionate even where personal use is prohibited. Where a breach can be established from elements other than content, separately accessing the correspondence is not considered necessary and proportionate. Where personal use is permitted and work-related and private communications can be separated, monitoring must be limited to work-related communications, with private correspondence excluded. Where separation is not possible, the employer’s monitoring power must be interpreted more narrowly.
• Fifth, monitoring must follow a graduated approach. A more intrusive method may not be used where the purpose can be achieved through a less intrusive one. Content monitoring may be carried out in exceptional cases where traffic data monitoring is insufficient and access to content is necessary, supported by a stronger and specific legitimate justification. There must be a concrete suspicion, and the examination must be limited to the allegation. General and ongoing content examinations with an undefined scope must be avoided. Where misuse can be prevented through technical measures such as filtering or blocking, no general monitoring right arises. Monitoring through covert methods of which employees have not been notified in advance, or through tools that indiscriminately record all their actions, will be considered unlawful.
• Sixth, data obtained through monitoring must be retained only for as long as the purpose requires. Content monitoring must take account of the risk of processing special categories of personal data under Article 6 of the Law and the effects on third parties’ data contained in correspondence. Access must be restricted to a limited number of personnel authorized for this task; authorizations must be defined through job descriptions, access logs must be maintained, and those accessing the data must be subject to confidentiality obligations.
• Finally, following the termination of the employment relationship, the legal basis for processing in connection with the corporate email account must be assessed separately. As a rule, the account must be closed to the employee’s active use and to new access, incoming messages must not be viewed by persons with no relevant role, and data for which no legal basis remains must be disposed of. However, limited and time-bound forwarding, automatic replies, archiving or retention may be considered in the circumstances of the case for business continuity, maintaining corporate communications, exercising the right of defence in legal disputes, or complying with statutory obligations. Access authorizations must be defined and these operations must be recorded.

Conclusion and Practical Implications

The Principle Decision requires employers to review both their policies governing the use of communication tools and their actual monitoring practices. In this respect, the key action points for data controllers can be summarized as follows:

• Clearly define and communicate the rules governing corporate email and other workplace communication channels, including whether personal use is permitted;
• Make employee privacy notices specific as to the legal basis, scope and method of monitoring and retention periods, and reassess processes relying on general notifications or solely on explicit consent;
• Distinguish between traffic/log examination and content monitoring, and determine the justification and limits of content monitoring on a case-by-case basis;
• Restrict access authorizations, maintain access logs, and align retention and disposal processes with the purpose of monitoring;
• Revise the processes for closing, forwarding and archiving departing employees’ accounts by defining time limits and access restrictions.

The Board did not grant a separate compliance period under the Principle Decision. It states that, where non-compliance is identified, an examination will be carried out in light of the circumstances of the case and administrative action will be taken against the relevant data controllers under Article 18 of the Law. Data controllers should therefore review their existing policies and practices in coordination with their human resources, information technology and legal departments.