The Personal Data Protection Board’s (the “Board”) Principle Decision No. 2026/2035 (the “Principle Decision”), published in the Official Gazette dated 8 October 2026, sets out specific findings and assessments regarding personal data processing activities carried out through the monitoring of corporate email accounts allocated to employees by employers and other communication channels used for the conduct of work.
As previously underlined both in the Board’s decisions (Decision No. 2021/1187 dated 25 November 2021 and Decision No. 2023/86 dated 19 January 2023) and in various Constitutional Court judgments (Application No. 2016/13010 dated 17 September 2020 and Application No. 2018/34548 dated 28 December 2021), the Principle Decision emphasizes the need to strike a balance between the employer’s managerial authority and the employee’s right to the protection of personal data and freedom of communication when monitoring communication channels. Similarly, the Principle Decision states that the employee must be explicitly informed in advance, that monitoring must be based on a legitimate purpose and be limited and proportionate to that purpose, and that less intrusive methods must be given priority.
In this context, with regard to the monitoring by employers of communication channels used by employees for the conduct of work, the Board underlines in the Principle Decision that the following points must be taken into account:
I. Nature and Limits of the Monitoring Authority
- The processing of traffic/log records by the employer constitutes, in and of itself, a personal data processing activity.
- The fact that communication tools belong to the employer or are used at the workplace does not grant the employer unlimited monitoring authority.
- The employer’s technical ability to access data does not mean that it has the legal authority to do so.
II. Distinction Between Work-Related and Personal Use
- Whether and how the employer has distinguished between the “work-related” and “personal” use of communication tools may lead to different outcomes in the assessment of the lawfulness of the monitoring activity.
- Any rules set by the employer on the personal use of workplace communication tools must be clear, understandable and accessible to employees, and any restriction must be explicitly communicated to employees.
- Even where the personal use of communication tools is prohibited, the employer’s monitoring authority is limited by the principle of proportionality. Continuous and uninterrupted monitoring cannot be considered proportionate. If a breach of the prohibition on personal use can be identified without accessing the content, accessing the content is deemed unnecessary and disproportionate.
- Where the employer permits the personal use of communication tools, monitoring should, where possible, be limited to work-related communications, and personal content should be excluded from monitoring. Where work-related and personal use cannot be separated, the employer’s monitoring authority must be interpreted narrowly.
III. Obligation to Inform and Legal Basis
- Merely informing the employee of the monitoring activity does not mean that the obligation to inform regarding the personal data processing activity has been fulfilled in accordance with Article 10 of the Personal Data Protection Law No. 6698 (the “Law”).
- The privacy notice to be provided by the employer must set out, in a clear, understandable and concrete manner, (i) the legal basis of the personal data processing activity, (ii) its purpose, (iii) its scope, (iv) whether monitoring will be carried out through the review of traffic/log records or through content monitoring, (v) the circumstances in which content may be accessed, (vi) the retention period of the data and (vii) the rights of data subjects under Article 11 of the Law.
- General statements that the employer may carry out monitoring do not satisfy the “notification” requirement and do not constitute fulfillment of the obligation to inform. In such cases, it must be taken into account that the employee may have a reasonable expectation that their personal data and freedom of communication will not be interfered with.
- Due to the dependency inherent in the employment relationship and the imbalance of power between the parties, the employee’s explicit consent should not be relied upon as the primary legal basis. Where explicit consent is relied upon, whether it was freely given must be assessed on a case-by-case basis.
- With regard to monitoring activities, the employer may rely on the processing conditions set out in the Law, namely that processing is “necessary for compliance with a legal obligation of the data controller”, “necessary for the establishment, exercise or protection of a right” and “necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”. However, the existence of these conditions does not grant the employer unlimited monitoring authority.
IV. Proportionality and Graduated Monitoring
- Monitoring must be carried out in accordance with the law and the principle of good faith, based on a specific, explicit and legitimate purpose, and in a manner that is relevant, limited and proportionate to that purpose. The data obtained must be retained only for as long as the purpose requires.
- If the employer can achieve its legitimate purpose through a less intrusive method, it should not resort to a more intrusive monitoring method. If the misuse of communication tools can be prevented by technical means, the employer will not have a general right to monitor. Access to the content of communications may only be considered in exceptional cases where the monitoring of traffic data is insufficient and access to the content is necessary.
- Monitoring the content of communications constitutes the most intensive interference with the employee’s private life and freedom of communication. Therefore, it requires a strong and concrete legitimate justification. Content reviews that are undefined in scope, general or continuous must be avoided.
- Monitoring carried out through covert and continuous surveillance methods without the employee’s knowledge is unlawful.
V. Data Security and Access Management
- When monitoring is carried out, special categories of personal data and personal data of third parties that may be contained in communications must also be taken into account.
- Access to data obtained from corporate email accounts and other communication channels must be limited to a specific number of personnel assigned and authorized for this purpose. Access rights must be defined in job descriptions, access logs must be kept, and personnel accessing the data must be bound by confidentiality obligations.
VI. Termination of the Employment Relationship
- As a rule, the corporate email account of an employee whose employment has ended must be closed to use and new access, and personal data for which there is no longer a legal basis must be destroyed. However, for purposes such as business continuity, exercising the right of defense or complying with legal obligations, forwarding, automatic reply or archiving arrangements may be implemented, provided that they are limited, time-bound and subject to defined access rights.
The Principle Decision brings together the principles shaped by the decisions of the Board and the Constitutional Court and sets out in concrete terms the framework of employers’ authority to monitor corporate communication channels. Where it is determined that the principles set out in the Principle Decision have been breached, administrative sanctions may be imposed on the relevant data controllers pursuant to Article 18 of the Law.
You can access the full text of the Principle Decision in Turkish, here.
Authors: Sümeyye Uçar, Rana Deliktaş