The Turkish Personal Data Protection Board (the “Board”), in its Principle Decision dated 16 September 2026 and numbered 2026/2035 (the “Principle Decision”), sets out its assessments and the requirements applicable to personal data processing carried out when employers monitor communication channels used for work purposes, particularly corporate email accounts assigned to employees.
The Principle Decision emphasizes the need to strike a balance between the employer’s managerial authority and the employee’s rights to personal data protection and freedom of communication. It addresses the use of communication tools for work and personal purposes, employees’ reasonable expectations of privacy, prior notification of monitoring, and the scope and limits of monitoring. The key principles are summarized below.
- Scope of monitoring: In addition to corporate email accounts, internal messaging applications, customer relationship and request management systems, and chat and recording functions on meeting platforms may be subject to monitoring, depending on the circumstances. Reviewing traffic/log records alone, without accessing communication content, also constitutes personal data processing and is subject to Law No. 6698 on the Protection of Personal Data (the “Law”).
- Distinction between work and personal use: Employers may prohibit the personal use of communication tools or make such use subject to certain conditions, provided that these rules are clearly communicated to employees in understandable terms. Even where personal use is prohibited, monitoring must remain proportionate; continuous and uninterrupted surveillance is not considered proportionate. Where a breach of the prohibition can be established without examining the content of communications, that content should not be accessed. Where personal use is permitted and work-related and personal communications can be distinguished, monitoring must be limited to work-related communications, with personal correspondence excluded. Where this distinction cannot be made, the employer’s monitoring authority must be interpreted more narrowly.
- Distinction between technical access and lawful access: An employer’s technical authority over a device or system does not entitle it to freely access correspondence in an employee’s personal email, messaging or social media accounts.
- Prior notification and privacy information: Before monitoring takes place, employees must be informed through a privacy notice that complies with the Law and provides clear information on the purpose, scope and method of monitoring. Where employees have not been informed in advance and provided with the required privacy information, their reasonable expectation that their personal data and freedom of communication will not be interfered with must be taken into account. General statements indicating only that corporate email accounts may be monitored are insufficient.
- Legal basis and explicit consent: Given the dependency inherent in the employment relationship and the imbalance of power between the parties, explicit consent should generally not be treated as the primary legal basis. Where explicit consent is relied upon, whether it has been freely given must be assessed separately. Depending on the circumstances, monitoring may rely on the necessity of processing to comply with a legal obligation, establish, exercise or protect a right, or pursue a legitimate interest, provided that the data subject’s fundamental rights and freedoms are not harmed.
- Compliance with general principles: Monitoring must be conducted lawfully and fairly, serve a specific, explicit and legitimate purpose, and be relevant, limited and proportionate to that purpose. The personal data obtained must be retained only for as long as required by the purpose.
- Graduated monitoring and limits on access to content: Employers must not resort to more intrusive monitoring methods where their legitimate purpose can be achieved through less intrusive means. Access to content may be considered only in exceptional circumstances where reviewing traffic data is insufficient and access to content is necessary. Content monitoring requires a stronger and concrete legitimate justification. It must be undertaken only where there are specific grounds for suspicion and must be limited to the allegation concerned. Indiscriminate, ongoing content reviews with an undefined scope must be avoided. Where misuse of communication tools can be prevented through technical measures such as filtering or blocking, the employer does not acquire a general right to monitor.
- Special categories of personal data and third-party data: Content monitoring must take account of the risk of processing special categories of personal data contained in the body of messages or their attachments. As correspondence may also contain personal data relating to recipients, the impact of monitoring on third-party data must also be considered.
- Covert and indiscriminate monitoring: Monitoring through covert methods of which employees have not been informed in advance, or through tools that indiscriminately record all employee activity, is considered unlawful. Monitoring must be conducted with the employee’s knowledge and within a foreseeable framework.
- Data access permissions: Access to data obtained through monitoring must be restricted to a limited number of personnel specifically authorized for this task. Access permissions must be defined in job descriptions, access logs must be maintained, and individuals accessing the data must be subject to confidentiality obligations.
The Board also emphasizes that, where non-compliance with these requirements is identified, the necessary investigation will be conducted considering the circumstances of the case, and administrative action will be taken against the relevant data controllers under Article 18 of the Law.
The Principle Decision is available
here.
Aslı Kınsız, Managing Associate
Sevim Özkan, Associate
Yiğit Ali Keleş, Trainee Lawyer