No blank cheque for the inbox: Turkish Data Protection Board sets the rules for employer monitoring of corporate e-mail

Employers in Türkiye no longer need to piece together the limits of workplace e-mail monitoring from scattered case law and individual Board decisions. On 8 October 2026, the Personal Data Protection Board (the “Board”) published in Official Gazette No. 33394 its Principle Decision No. 2026/2035 of 16 September 2026 on the procedures and principles to be observed in personal data processing carried out by monitoring communication channels used for business purposes, in particular corporate e-mail accounts allocated to employees (the “Principle Decision”). The Board adopted the Principle Decision by majority vote under Article 15(6) of Law No. 6698 on the Protection of Personal Data (“Law No. 6698”), which empowers it to issue a principle decision where an examination reveals that a violation is widespread.

The bottom line is clear for employers: owning the device, the server or the domain does not confer a right to read. Monitoring, even of traffic and log data alone, is a processing activity in its own right. It must be announced in advance through a proper privacy notice, must be graduated and proportionate, and may reach the content of correspondence only exceptionally and on the basis of concrete suspicion. Where the Board finds non-compliance, it may take administrative fine against the data controller under Article 18 of Law No. 6698.

Why the Board stepped in

The Board frames the corporate e-mail account as far more than a communication tool: it is a data source that holds the employee’s professional, and at times personal, network of relationships, working patterns and correspondence. Monitoring it therefore calls for a balance between the employer’s managerial prerogative and the employee’s right to the protection of personal data and freedom of communication under Articles 20 and 22 of the Turkish Constitution. Referring to the case law of both the Turkish Constitutional Court and the European Court of Human Rights, the Board recalls that employer monitoring is tied to clear prior notice to the employee, a legitimate aim, limitation to that aim and proportionality, and a preference for less intrusive means, and that reviewing content requires weightier justification than reviewing traffic data.

Importantly, the Principle Decision is not confined to e-mail. Internal messaging applications, corporate instant messaging accounts, customer relationship and ticketing systems, and the chat and recording areas of meeting platforms may all be subject to monitoring depending on the circumstances. For applications that also lend themselves to personal use, the Board requires a separate assessment of whether the account was allocated for business purposes, whether it is used through the employee’s personal account, and what privacy the employee may reasonably expect.

Logs count too: ownership is not a licence

The Board’s starting point is that processing only traffic and log records, without accessing content, is in itself a personal data processing activity. E-mail monitoring of any kind is therefore subject to the general principles in Article 4 of Law No. 6698, the processing conditions in Articles 5 and 6, the duty to inform in Article 10 and the data security obligations in Article 12. The fact that the communication tools belong to the employer, or are used at the workplace, does not grant the employer unlimited monitoring power.

The Principle Decision does not operate in isolation. Article 419 of the Turkish Code of Obligations No. 6098 already permits employers to process employee data only insofar as it relates to the employee’s suitability for the job or is necessary for the performance of the employment contract, and Article 417 obliges the employer to protect the employee’s personality rights. Unauthorised access to private communications may also engage Articles 132 (violation of the confidentiality of communication) and 136 (unlawfully obtaining or disclosing personal data) of the Turkish Criminal Code No. 5237. The exposure is therefore not merely administrative.

Business use versus private use: the policy does the heavy lifting

The scope of permissible monitoring turns on the distinction between business use and private use. Whether the employer has prohibited private use, permitted it within certain limits or left the issue unregulated may lead to different outcomes when the lawfulness of monitoring is assessed. Employers may set rules on private use under their managerial prerogative, but those rules must be clear, understandable and knowable to the employee, and any prohibition or restriction must be expressly communicated.

Even a prohibition does not open the door to unlimited review. Monitoring remains bound by proportionality; continuous, uninterrupted surveillance cannot be considered proportionate; and where a breach of the private-use ban can be established from non-content elements, separately accessing the content of correspondence will not be considered necessary and proportionate. Where private use is permitted and business and private communications can be separated, monitoring must be confined to business communications and private correspondence must be left out. Where they cannot be separated, the employer’s monitoring power is to be interpreted more narrowly.

The Board also draws a sharp line between technical capability and legal authority. Having technical privileges over a device, session, network or corporate system does not mean that the employer may freely access the employee’s personal e-mail account, personal instant messaging application, social media inbox or similar private communication spaces.

Notice: a one-line clause will not do

Prior notice is one of the decisive factors in assessing lawfulness. The Board notes, however, that the “informing” required in Constitutional Court case law and the duty to inform under Article 10 of Law No. 6698 are not identical concepts: not every communication amounts to a privacy notice, but a proper Article 10 notice containing clear information on the purpose, scope and method of monitoring can also satisfy the prior-informing requirement.

The notice must go beyond abstract and general statements and set out, in a clear, understandable and concrete manner: the legal basis, purpose and scope of processing; whether monitoring will be carried out through traffic/log records or content review; the circumstances in which content may be accessed; the retention period; and the employee’s rights under Article 11 of Law No. 6698. An employee who has not been informed in advance may hold a reasonable expectation that their personal data and freedom of communication will not be interfered with. A generic statement that the corporate e-mail account “may be monitored by the employer” satisfies neither the informing requirement nor the Article 10 duty.

Consent is not the default

Given the dependency inherent in the employment relationship and the imbalance of power between the parties, the Board states that explicit consent should not, as a rule, be relied upon as the primary legal basis for e-mail monitoring. Where consent is relied upon, whether it was freely given must be assessed on the facts. Depending on the circumstances, monitoring may instead rest on Article 5(2)(ç) of Law No. 6698 (compliance with a legal obligation of the data controller), Article 5(2)(e) (establishment, exercise or protection of a right) or Article 5(2)(f) (legitimate interests of the data controller, provided the data subject’s fundamental rights and freedoms are not harmed). The existence of these grounds, however, does not grant unlimited monitoring power either.

A graduated ladder: from logs to content

Monitoring must comply with the general principles in Article 4 of Law No. 6698: it must be lawful and fair, based on a specified, explicit and legitimate purpose, relevant, limited and proportionate to that purpose, and the data obtained must be kept only for as long as that purpose requires. Graduation is the governing principle. If the employer can achieve its legitimate aim through a less intrusive route, it may not resort to a more intrusive method. Access to content may arise only in exceptional cases where traffic-data review is insufficient and access is indispensable. Where misuse of business communication tools can be prevented by technical means such as filtering or blocking, no general right of monitoring arises.

Content review constitutes the most intensive interference with the employee’s private life and freedom of communication and therefore requires a stronger and concrete legitimate justification. It should be used only where there is concrete suspicion, and only to the extent of the allegation; open-ended, general and continuous content reviews must be avoided.

Collateral data, covert tools and access controls

Three further guardrails complete the framework. First, content reviews must take into account the risk of processing special categories of personal data within the meaning of Article 6 of Law No. 6698 in the body or attachments of messages, as well as the impact on third parties, since correspondence frequently contains the personal data of counterparties. This point carries particular weight because, even after the 2024 amendments introduced by Law No. 7499, legitimate interest is not among the grounds on which special category data may be processed under Article 6. Second, monitoring carried out through covert methods of which the employee was not informed in advance, or through tools that record all of the employee’s activities indiscriminately, will be deemed unlawful; monitoring must take place within the employee’s knowledge and within a foreseeable framework. Third, access to data obtained from corporate e-mail accounts and other business communication channels must be restricted to a limited number of personnel authorised for that task, with access rights defined by job descriptions, access logs maintained and those with access bound by confidentiality obligations.

When the employee leaves

After termination, the legal basis for processing relating to the former employee’s corporate e-mail account must be assessed separately. As a rule, the account should be closed to the employee’s active use and to new access, incoming messages should not be viewable by unrelated persons, and personal data for which no legal basis remains should be destroyed. That said, limited and time-bound forwarding, auto-reply, archiving or retention arrangements -with defined and logged access rights- may be considered on the facts where needed to ensure business continuity, avoid disruption to corporate communications, exercise the right of defence in legal disputes or comply with legal obligations.

Practical implications: what employers should do now

Map what you monitor. Inventory every channel subject to monitoring, e-mail, collaboration and instant messaging tools, CRM and ticketing systems, meeting recordings, and record for each whether logs or content are processed, by whom, on what legal basis and for how long.

Write the private-use rules down. Decide whether private use of business tools is prohibited, permitted within limits or permitted subject to time, scope and method conditions, and communicate that choice expressly and verifiably to employees. Leaving the point unregulated is itself a choice the Board will weigh.

Replace generic clauses with a real privacy notice. Employee privacy notices should be updated to cover each element listed by the Board, including the distinction between log and content monitoring and the circumstances in which content may be accessed. Workplace policies and employment contract clauses that merely state that e-mail “may be monitored” should be revisited.

Re-paper the legal basis. Monitoring that currently relies on blanket consent forms should be re-anchored in Article 5(2)(ç), (e) or (f) of Law No. 6698, as applicable, and supported by a documented legitimate interest and proportionality assessment.

Build an escalation protocol for investigations. Internal investigations are where the Principle Decision will bite first. A written protocol should start with log data, escalate to content only on a documented concrete suspicion, scope any review to the allegation (custodians, date ranges, search terms), filter out private and special category data, and limit review to authorised personnel with logged access.

Retire indiscriminate tools. Technical prevention such as filtering and blocking is favoured. Tools that record all employee activity across the board, or that operate covertly, should be reviewed and switched off or reconfigured.

Mind the evidential dimension. Monitoring that does not comply with the Principle Decision exposes the employer to administrative fines under Article 18 of Law No. 6698, which, since the amendments by Law No. 7499 took effect on 1 June 2024, are challenged before the administrative courts. It also puts the evidence itself at risk: under Article 189(2) of the Code of Civil Procedure, Law No. 6100, unlawfully obtained evidence cannot be taken into account by the court. A dismissal built on such material may therefore fail before the labour courts, leaving the employer facing reinstatement or compensation claims. Monitoring processes should be designed with litigation in mind from the outset, with professional legal support.

Adopt a leaver protocol. Account closure, auto-reply, time-limited forwarding, archiving and litigation-hold retention should each be defined in advance, with access rights recorded and data without a remaining legal basis destroyed.

Close the documentation loop. Reflect each monitoring activity in the personal data processing inventory and, where registration is required, in VERBİS, and align retention periods with the employer’s personal data retention and destruction policy so that the periods disclosed in the privacy notice are the periods actually applied.

Conclusion

The Principle Decision moves the conversation from whether employers may monitor to how they must do so. Its message is consistent throughout: transparency first, the least intrusive means available, content only as an exception, and documented safeguards at every step. Because principle decisions are the Board’s response to violations it considers widespread, employers should expect this one to serve as the benchmark in future complaints and ex officio examinations. Those who review their monitoring practices, policies and notices now will be best placed to defend both their investigations and their employment decisions.

For further information on the implications of this Principle Decision for your business, please contact your CMS partner or CMS Türkiye team: Dr. Döne Yalçın and Erdinç Dalar.