I. Introduction
Corporate email accounts and the devices employers assign to staff hold information an employer may need not only for day-to-day business but also in internal investigations, security checks and when someone leaves. Because the tools belong to the employer, companies generally assume they have unlimited monitoring rights over them. Yet the same tools also reflect employees’ correspondence and, at times, their personal network, so an employer that monitors them must weigh its management prerogative against employees’ rights to the protection of their personal data and to freedom of communication.
Turkey’s Personal Data Protection Board (the “Board”) has now set out the procedures and principles for striking that balance in Principle Decision No. 2026/2035 of 16 September 2026 (the “Decision”), published in the Official Gazette on 8 October 2026. Under the Decision, owning the tools, or being technically able to access them, does not entitle an employer to read employees’ correspondence as it pleases.
The Decision also states expressly that non-compliance will lead to administrative action against the data controller. Employers should therefore revisit their acceptable-use policies, privacy notices, investigation practices and handling of leavers’ mailboxes without delay.
II. Technical Access Is Not Legal Authority
For the Board, the right to monitor comes from the conditions of Law No. 6698 on the Protection of Personal Data (the “Law”). Because of that, even looking only at who emailed whom and when, without opening any message, is subject to those conditions: the Board treats the processing of traffic and log data as processing of personal data in its own right and subjects it to the Law’s general principles, legal grounds, transparency and data security obligations. Depending on the facts, the Decision’s criteria will also apply to other channels used for work, such as internal messaging tools, CRM and ticketing systems, and the chat and recording features of meeting platforms.
The point is sharpest for personal accounts reachable from company equipment. The Board states expressly that technical control over a device, session, network or corporate system does not entitle the employer to read messages in an employee’s personal email account, personal messaging app or social media inbox.
III. Banning Private Use Does Not Open the Door to Surveillance
The Decision accepts that employers may, under their management prerogative, set rules on private use of workplace tools, provided the rules are clear, understandable, knowable by employees and expressly communicated to them. A ban on private use is not, however, enough on its own to give the employer an unlimited right to monitor. The Board states that even where private use has been clearly prohibited and employees informed, the employer’s monitoring authority remains bound by proportionality and it may not keep employees under continuous, uninterrupted surveillance. If a breach of the ban can be shown without opening messages, opening them is not regarded as necessary or proportionate.
An employer that allows private use has even less room. Under the Decision, where work and private communications can be separated, monitoring should be confined to work communications; where they cannot, the employer’s monitoring authority must be read more narrowly.
IV. Policies, Privacy Notices and Consent
An employer whose policy or privacy notice does no more than say that corporate email may be monitored will not, under the Decision, have informed its employees adequately. The Board regards such general statements as insufficient both as prior notice and as a privacy notice, and expects the notice to state the legal ground, purpose and scope of monitoring, whether it covers traffic data only or also content, when content may be accessed, how long data will be kept and the employee’s rights. Because the Board requires account to be taken of the reasonable expectation of an employee who was not properly informed that their personal data and communications would not be interfered with, in our view a weak notice will leave later monitoring open to challenge. Covert monitoring, and tools that record all of an employee’s activity indiscriminately, are unlawful in the Board’s view.
Asking employees for explicit consent is not, as a rule, the answer. Because of the dependence inherent in employment and the imbalance of power between the parties, the Board says consent should not as a rule be the primary legal basis for monitoring, and accepts that monitoring may instead rest, depending on the facts, on legal obligation, the establishment, exercise or protection of a right, or legitimate interest. Relying on one of these grounds does not, however, remove the limits on how monitoring is carried out.
V. Content Review and Internal Investigations
The most concrete limit in the Decision is its stepped approach. The Board states that an employer that can achieve its legitimate aim by less intrusive means may not use a more intrusive method, and that where misuse of communication tools can be prevented technically, for example by filtering or blocking, no general right to monitor arises.
For internal investigations, this means that rather than searching a whole mailbox on a suspicion, the employer should look at traffic data first and, if content is needed, confine the review to the messages the suspicion concerns. The Board describes content review as the most serious interference with an employee’s private life and freedom of communication, and states that messages may be opened only in exceptional cases where traffic data is insufficient and access to content is necessary, only where there is a specific suspicion and only to the extent of that suspicion. The Board also expects reviewers to take account of special categories of data and of the data of the other parties to the correspondence, access to be limited to a small number of authorised staff, each access to be logged and those staff to be bound by confidentiality.
VI. Leavers’ Mailboxes
Contrary to what an employer wishing to keep a leaver’s mailbox open to follow incoming mail might expect, the Decision treats closing the account as the rule and keeping it open as the exception. When employment ends, the account should as a rule be closed to the former employee and to new access, incoming mail should not be visible to unrelated persons, and data with no remaining legal basis should be destroyed. The Board states that forwarding, automatic replies, archiving or retention used for business continuity, ongoing business communications, the right of defence or compliance with other legislation, and kept limited, time-bound, with defined access rights and a record, may be assessed in light of the specific facts. In other words, they are not a general option open to the employer but an exception that has to be justified case by case.
VII. General Assessment
Employers should treat monitoring not as a routine management tool but as an exception with conditions set in advance. Acceptable-use policies should state whether private use is permitted and within what limits; privacy notices should cover the elements the Board lists; and investigation procedures should set out what level of suspicion justifies a content review, who approves it and what it may cover. Exit procedures should fix when the mailbox will be closed and when retained messages will be destroyed. In our view, given the Board’s requirement that retention be limited and time-bound, keeping a leaver’s mailbox open indefinitely is not consistent with the Decision.
The Board states that where non-compliance with the Decision is found, administrative action will be taken under Article 18 of the Law, which provides for separate administrative fines for breaches of the transparency obligation, the data security obligations and Board decisions. The Decision does not address whether messages obtained through monitoring can be used as evidence in employment litigation or whether a dismissal based on them is valid. An employer relying on messages obtained in breach of the Board’s criteria may, however, face objections on both points, so they should be assessed under Turkish employment law in each case.
