New Turkish Data Protection Authority Decision on Monitoring Employees' Corporate Emails and Communication Channels
A new principle decision issued by the Turkish Personal Data Protection Board (the "Board"), dated 16 September 2026 and numbered 2026/2035 (the "Decision"), was published in the Official Gazette on 8 October 2026. The Decision clarifies the rules employers must follow when monitoring corporate email accounts and other work-related communication channels provided to employees.
The Decision does not represent an entirely new approach. In previous rulings, the Turkish Constitutional Court had already established that an employer's ownership of a corporate email account does not, in itself, justify unrestricted access to an employee's correspondence. The need for a legitimate purpose, prior notice to employees and a necessary and proportionate approach to monitoring has therefore long been part of the legal framework.
Rather than changing these principles, the Decision provides further guidance on how they should be applied under Turkish Personal Data Protection Law No. 6698 (the "DPL").
1- Limits on Employers' Monitoring Rights
Employers may monitor corporate communication tools for legitimate business purposes, including business continuity and information security. However, the Board makes clear that this authority is not unlimited.
Monitoring must serve a specific and legitimate purpose, remain within the scope of that purpose and avoid unnecessary interference with employees' rights.
Importantly, the Board distinguishes between reviewing traffic or log data and accessing the actual content of communications. Since reviewing message content represents a more intrusive measure, employers should first consider whether less intrusive methods would be sufficient.
In practice, this means that broad or continuous monitoring of communication content should be avoided. Any content review should instead be based on a specific justification and limited to what is necessary.
2- Informing Employees in Advance
Another important aspect of the Decision is the requirement to inform employees about monitoring activities in advance.
Simply stating that corporate email accounts may be monitored is not sufficient. Employees should be informed of the reasons for monitoring, the methods used, the categories of data that may be accessed, applicable retention periods and their rights under the DPL.
The Board also draws attention to the imbalance of power inherent in employment relationships. As a result, employee consent may not always provide an appropriate legal basis for monitoring activities.
Employers should therefore ensure that monitoring is supported by a valid legal basis under the DPL, rather than relying solely on employee consent or general contractual provisions.
3- Scope of Monitoring and Data Security
The Decision extends beyond corporate email accounts. It also covers internal messaging applications and other digital communication channels used for business purposes.
Monitoring these systems may involve access to employees' private correspondence or personal data relating to customers, suppliers and other third parties. Employers should therefore restrict access to authorised personnel, maintain appropriate access records and avoid retaining data for longer than necessary.
The Board's approach is also relevant when an employee leaves the company. Although employers may have legitimate business reasons to preserve certain communications, business continuity does not automatically justify unrestricted access to all information held in a former employee's account.
4- Practical Implications for Companies
The Decision does not remove employers' ability to monitor corporate communication tools. Instead, it reinforces the need to reflect the established principles of legitimate purpose, necessity, proportionality and prior notice in day-to-day business practices.
Against this background, we recommend that companies consider the following steps:
Review existing policies and privacy notices. Internal policies governing corporate email and other communication tools should clearly explain the purpose, scope and methods of monitoring.
Establish clear monitoring procedures. Companies should define when traffic and log data may be reviewed, when access to communication content may be justified and who is authorised to carry out such reviews.
Review internal investigation and disciplinary practices. Where monitoring takes place in connection with disciplinary proceedings or termination of employment, the reasons for the review and its scope should be properly documented.
Strengthen data security measures. Access to communication data should be restricted, access logs maintained and appropriate safeguards considered to distinguish business communications from private correspondence.
Review employee exit procedures. Companies should establish clear rules on closing former employees' accounts, accessing business-related information and retaining data where necessary.
In conclusion, the Decision does not introduce a new prohibition on employee monitoring. It reinforces the importance of ensuring that existing legal requirements are reflected in companies' actual practices.
Companies should therefore look beyond updating privacy notices and review their monitoring arrangements more broadly, with particular attention to necessity, proportionality and accountability.
Failure to comply with these requirements may, depending on the circumstances, result in administrative sanctions under the DPL.
Author
Ömer Faruk Çıkın
