Last updated: 2026-10-12
Employers in Türkiye can monitor workplace communications under appropriate conditions. Owning the email account, paying for the software or having administrator access does not, by itself, make every inspection lawful.
The Personal Data Protection Board’s Decision 2026/2035 sets out conditions for monitoring corporate email and other communication channels used for work. For HR, IT and compliance teams, the practical task is to connect each monitoring activity to a defensible purpose, an applicable legal basis and controls that limit what people can access.
The Board adopted Decision 2026/2035 on 16 September 2026. It was published in the Official Gazette on 8 October 2026, issue 33394. These are separate dates.
This is a published principle decision, rather than a consultation draft. It addresses the application of existing personal-data protection obligations to workplace communications. It contains no specific transition period.
Its scope extends beyond corporate email, but it does not name particular messaging or meeting platforms. Employers should therefore assess communication functions individually: workplace chat, meeting recordings and transcripts may involve different information, purposes and levels of intrusion.
The decision does not establish a blanket ban on monitoring. Nor should publication be treated as the date on which employee privacy first became relevant.
An employer may set rules for company systems and protect its business interests. Employees nevertheless retain constitutional protections for their private life, personal data and communications.
These interests require a contextual assessment. A work-only policy can explain acceptable use, but it cannot make every intrusion proportionate. Where business and private communications cannot be clearly separated, the decision calls for a narrower assessment of monitoring powers.
Technical access creates a particular risk. An administrator may be able to reset credentials, export a mailbox or reach an account left signed in on a company laptop. That capability does not establish legal authority to inspect the information.
For implementation, distinguish between:
The third category should not be absorbed into an ordinary corporate-mailbox review. Before accessing private communications, establish the specific legal justification and necessity, consider alternatives and obtain qualified legal review where the intrusion is material. A suspected policy breach alone should not be treated as permission to search every accessible account.
Article 5 of Law No. 6698 provides processing conditions that may be relevant, depending on the facts. These include processing necessary to comply with a legal obligation, establish or protect a right, or pursue the controller’s legitimate interests without violating the individual’s fundamental rights and freedoms.
The contractual condition is narrower than “the employee signed a contract”: processing must be necessary and directly related to establishing or performing that contract.
Avoid assigning one legal basis to an entire monitoring product. Security logging, targeted message review, disclosure to an investigator and retention for litigation can require separate assessments.
Earlier published Board decisions recognize employer interests such as protecting commercial confidentiality, preventing unlawful conduct, safeguarding against legal liability and managing information flows. Their recognition does not automatically authorize any chosen method.
Describe the actual problem. For example:
These are examples for assessment, not pre-approved monitoring programmes. “Security” or “management oversight” is too vague to explain why a particular employee’s messages need to be read.
Decision 2026/2035 does not prescribe a standard assessment form. The Board’s earlier legitimate-interest decision requires a balancing assessment, including a present and identifiable interest, necessity and effects on individual rights.
A practical written record should answer:
This format is an implementation recommendation. A signed form cannot rescue an activity that fails the underlying necessity and rights assessment.
Explicit consent must be specific, informed and freely given. A general agreement to all monitoring is not a reliable substitute for assessing particular activities.
The employment relationship makes freedom of choice especially important. Consider whether an employee can realistically refuse or withdraw consent without disadvantage. A signature collected during onboarding does not settle that question.
Keep three functions separate in your documents: explaining acceptable use, providing a privacy notice and requesting consent where consent is genuinely the appropriate basis.
An acknowledgement that an employee received a policy can help demonstrate delivery. It should not be presented as automatic consent to everything described in it. Valid consent also does not remove the requirements of necessity, proportionality and limited retention.
Article 10 requires information about the controller, processing purposes, recipients and transfer purposes, collection methods and legal basis, and the individual’s Article 11 rights.
The new decision distinguishes constitutional prior information from the statutory privacy-notice obligation. A general warning about monitoring does not necessarily satisfy both.
For a useful monitoring notice, explain the operational detail employees would otherwise have to guess:
Explain any intended use in disciplinary processes clearly. Do not describe a tool as collecting only technical logs if reviewers can also retrieve message bodies or attachments.
As a practical control, retain the notice version, delivery date and evidence of distribution. Update the notice when a material change to monitoring changes the processing employees were told about.
Communication-flow monitoring and content review involve different levels of intrusion. Earlier Board decisions expressly recognize that inspecting contents requires stronger justification.
Technical logs can still be personal data. Sender and recipient details, timestamps and sign-in records can reveal working patterns and relationships. They are not outside KVKK simply because they omit the message body.
For implementation, inspect the fields your tools actually expose. A screen labelled “message trace” may include a subject line; a security alert may contain a message excerpt or attachment information. Treat those disclosures according to what they reveal.
Automated inspection also involves processing. The absence of a human reader does not remove the need to assess its purpose, scope, outputs and retention.
The decision says content review should, as a rule, be tied to concrete suspicion or a legitimate purpose connected with a specific incident, and remain limited to that purpose. It cautions against indefinite, general and continuous content inspection.
Consider this hypothetical example:
A security alert indicates that a customer export may have been sent outside the company. The team could first examine the relevant account activity, destination, timing and available transfer records. If those records answer the question, broader reading may add no necessary value.
If uncertainty remains and content review is justified, the next step could be limited to the identified messages and attachments. It should not automatically become a search of every conversation the employee has had.
The assessment should explain why each increase in access is necessary.
The decision does not prescribe a particular approval committee or job title. Organizations should establish their own authorization procedure.
A practical investigation request should specify the allegation or incident, proposed legal basis, accounts and dates, search limits, permitted reviewers, intended use of findings and retention arrangements. It should also explain how unrelated private material will be handled.
For sensitive cases, consider separating the person requesting access from the person approving it. Require additional approval before expanding the search to another employee, a longer period or a different purpose.
Urgent incidents need a workable escalation route. For example, a response team may need to disable a compromised account quickly. That containment action should not silently authorize unrestricted reading of its historical correspondence.
Preserving information and examining its contents are separate processing activities. Assess both; a preservation decision does not automatically justify broad inspection.
A message may contain health information, trade-union membership or other special-category data. Article 6 requires an applicable special-category processing condition and the prescribed safeguards. An Article 5 legitimate-interest assessment alone is insufficient.
The employment-related condition in Article 6 concerns processing necessary to fulfil relevant legal obligations. It is not a general exemption for anything an employer discovers.
Communications also contain information about customers, relatives, suppliers and other employees. Reviewers should consider their privacy, even when the investigation concerns only one account holder.
As an operational procedure, instruct reviewers to:
For example, a medical attachment encountered during an unrelated expense investigation should not be copied into a general HR report merely because the reviewer can open it.
Article 12 requires appropriate technical and organizational security measures. The decision specifically calls for limited, role-based access, access records and confidentiality safeguards.
Translate those requirements into the way administrators and investigators work. Recommended controls include separate administration and investigation roles, named reviewer accounts, time-limited permissions and approval records linked to each case.
Audit records should make it possible to establish who searched or exported information, when they did so and under which authorization. Protect those records from alteration and review unusual access.
Include external IT providers and group-company teams in the access map. Where information is transferred abroad, assess Article 9 separately. A justified domestic investigation does not by itself establish a lawful international transfer arrangement.
A single retention period for “employee email data” is unlikely to reflect the different purposes involved.
As a practical starting point, distinguish operational logs, security alerts, investigation extracts, case reports and records preserved for a particular legal claim. For each category, document the purpose, relevant legal requirements, retention trigger, responsible owner and disposal method.
Under Article 7, when the reasons for processing no longer exist, the controller must erase, destroy or anonymize the data as applicable. An employee request is not a prerequisite for that obligation.
Review exports and copies as well as the main system. Information may remain in investigator folders, support tickets, downloaded archives or shared drives after it disappears from the original mailbox.
The decision does not provide a special regularization process for old monitoring data.
A sensible review should establish how the records were obtained, what employees were told, why the records are still held and who can access them. A new privacy notice should not be treated as retrospectively correcting an earlier failure.
Where collection or continued use appears problematic, restrict further access and obtain advice on remediation. Check actual preservation obligations before deletion, particularly for active proceedings. Equally, the possibility of a future dispute should not become an indefinite retention rule for every mailbox.
Past enforcement already demonstrates that accessing a former employee’s mailbox without adequate transparency can create KVKK exposure. In Decision 2021/1187, the Board addressed such access and also rejected the idea that private material becomes publicly disclosed simply because it is present in a corporate account.
For offboarding, distinguish business continuity from continued use of the former employee’s identity.
Recommended steps include transferring necessary business records before departure where feasible, revoking credentials and sessions, identifying genuinely necessary retained records and restricting archive access.
Consider whether a time-limited automatic reply directing correspondents to an appropriate team can meet the business need. Avoid defaulting to indefinite forwarding of all incoming messages to a manager.
Document any continuing access, its purpose and its end or review date. Deactivating sign-in does not answer who can still read the archive.
A KVKK assessment is only part of the analysis.
Article 417 of the Turkish Code of Obligations requires employers to protect and respect employees’ personality rights. Article 419 limits the use of employee personal data to information related to suitability for work or necessary for performing the employment contract, while preserving special statutory provisions.
Constitutional protections under Articles 20 and 22 also matter. In the E.Ü. judgment of 17 September 2020, the Constitutional Court identified shortcomings involving prior information, the justification for content access, alternative means and the breadth of the review.
For employers, the practical implication is to assess both the evidence-gathering process and the proposed employment action. Finding potentially relevant information does not resolve whether it was lawfully obtained or whether a disciplinary response is justified and proportionate.
Seek qualified Turkish employment-law advice before intrusive private-communication searches or material disciplinary decisions.
Use the following as an implementation sequence:
A useful first review brings HR, IT and privacy responsibilities together around one real workflow. Compare what the policy says with what an administrator can actually retrieve, then close the gaps in authorization, notice, access and retention.
Kooch’s KVKK & GDPR Gap Analysis can help identify those operational gaps. For continued policy and control reviews, see Ongoing Compliance Management.
Contact Kooch to discuss a review of your employee-monitoring policies and procedures.
