Assessment of the Personal Data Protection Board’s Principle Decision No. 2026/2035 on the Monitoring of Corporate Email Accounts and Work-Related Communication Channels

Subject: Assessment of the Personal Data Protection Board’s Principle Decision No. 2026/2035 on the Monitoring of Corporate Email Accounts and Work-Related Communication Channels

Date: 12 October 2026

1. INTRODUCTION

On 16 September 2026, the Personal Data Protection Board (the “Board”) adopted its Principle Decision No. 2026/2035 (the “Principle Decision”)^[1] setting out the procedures and principles to be observed by employers when monitoring communication channels used for work purposes, particularly corporate email accounts assigned to employees. The Principle Decision was published in the Official Gazette dated 8 October 2026 and numbered 33394.

The significance of the Principle Decision lies in its express clarification that the fact that corporate communication tools belong to the employer or are used for work purposes does not confer an unrestricted right to access or monitor personal data contained in them. The Board requires an appropriate balance, having regard to the circumstances of each case, between the employer’s managerial and supervisory powers and the employee’s rights to the protection of personal data, respect for private life and freedom of communication.

This bulletin examines the scope and key principles of the Principle Decision and sets out legal and operational compliance recommendations to assist employers in reviewing their existing practices.

2. SCOPE AND LEGAL FRAMEWORK OF THE PRINCIPLE DECISION

The Principle Decision applies not only to corporate email accounts but also to internal messaging applications, corporate instant messaging accounts, customer relationship and request management systems, chat and recording functions on meeting platforms, and other communication channels used for work purposes that may be subject to monitoring depending on the circumstances. When assessing monitoring, consideration must be given to whether the account was provided by the employer, whether it is used for work or private purposes, the employee’s reasonable expectation of privacy and the applicable workplace usage rules.

According to the Board, even an employer’s examination solely of traffic or log data, such as sender, recipient and time information, constitutes processing of personal data. Accordingly, not only the reading of message content but also monitoring that does not involve access to content must comply with the general principles under Article 4 of Personal Data Protection Law No. 6698 (the “KVKK”), the conditions for lawful processing under Articles 5 and, where applicable, 6, the information obligation under Article 10, and the data security obligations under Article 12.

3. KEY PRINCIPLES ESTABLISHED BY THE PRINCIPLE DECISION

3.1. Distinguishing Work-Related Use from Private Use

As part of its managerial authority, an employer may prohibit or restrict the private use of corporate communication tools or permit such use subject to certain conditions. However, the applicable usage rules must be clear, understandable and made known to employees. The existence of workplace rules on private use directly affects the assessment of whether monitoring is lawful.

Even where private use is prohibited, the employer does not automatically acquire an unrestricted right to review communication content. For example, if a breach can be identified through technical measures without accessing content, reviewing correspondence may not be considered necessary or proportionate. Where work-related and private correspondence can be distinguished, monitoring should be limited to work-related communications; where they cannot be separated, the scope of the employer’s monitoring authority should be construed more narrowly. The Board does not consider continuous and uninterrupted surveillance proportionate.

3.2. Prior Information, Privacy Notice and Lawful Basis

Whether an employee has been informed before monitoring takes place is one of the decisive factors in assessing its lawfulness. However, informing an employee of an acceptable-use policy is not the same obligation as providing a privacy notice pursuant to Article 10 of the KVKK. A privacy notice that clearly explains the purpose, scope and method of monitoring in advance and also satisfies the requirements of Article 10 may help fulfil both requirements.

A general statement in a privacy notice that “corporate emails may be monitored” is insufficient. The lawful basis for monitoring, its purpose, whether it will be confined to traffic or log data or may involve reviewing content under specified conditions, the categories of data that may be accessed, the retention period and the rights of data subjects must be explained concretely, clearly and understandably. According to the Board, providing merely generic information does not satisfy the information obligation.

Given the relationship of dependence and imbalance of power inherent in employment, explicit consent should not, as a rule, be the first lawful basis relied upon for email monitoring. Depending on the circumstances, monitoring may be based on the processing conditions set out in Article 5(2)(ç), (e) or (f) of the KVKK; however, the availability of such grounds does not permit unlimited monitoring.

3.3. Graduated Monitoring, Concrete Suspicion and Proportionality

One of the most important aspects of the Principle Decision is its adoption of a graduated approach to monitoring. If an employer can achieve its legitimate objective through less intrusive means, it should not resort to a more intrusive measure. For example, direct examination of communication content may not be justified if a security risk can be addressed through technical filtering, access restrictions or narrowly targeted traffic or log analysis.

Content review may be considered in exceptional circumstances where examining traffic data is insufficient and access to content is necessary. The Board does not regard a general or abstract justification as sufficient to review correspondence; rather, monitoring must be based on concrete suspicion, confined to the allegation in question and supported by a compelling legitimate justification. Broad, undefined or ongoing reviews of communication content should be avoided.

Monitoring must serve a specific, explicit and legitimate purpose and must be relevant, limited and proportionate to that purpose. Data obtained must be retained only for as long as required by the monitoring activity. The possibility of processing special categories of personal data belonging to the employee or third parties involved in the correspondence must be assessed separately, and the impact on third parties’ data must also be taken into account.

According to the Principle Decision, covert surveillance conducted without the employee’s knowledge and the indiscriminate recording of all employee activities may give rise to unlawful processing. Monitoring should therefore be foreseeable to employees and carried out within a defined framework involving only such interference as is necessary.

3.4. Access to Monitoring Data and Termination of Employment

Access to data obtained through monitoring should be restricted to a limited number of duly authorised personnel whose duties require such access. Access rights should be linked to job descriptions, access logs should be maintained, and authorised personnel should be subject to confidentiality obligations. The technical ability to access data does not, in itself, amount to lawful authorisation to do so.

Following termination of employment, the lawful basis for accessing the former employee’s corporate email account and for processing data associated with that account must be assessed separately. As a general rule, active use should be discontinued, further access should be blocked, data should not be disclosed to unauthorised persons, and data for which no lawful basis remains should be deleted. Nevertheless, measures such as forwarding, automatic replies, archiving or retention may be considered on a case-by-case basis for business continuity, uninterrupted corporate communication, the right to defend legal claims or compliance with statutory obligations, provided their duration, scope and access permissions have been defined in advance.

4. COMPLIANCE AND RISK MITIGATION FOR EMPLOYERS

In light of the Principle Decision, companies should review their current practices concerning corporate email and other work-related communication channels not only from an information security perspective but also from the perspectives of personal data protection and employment law. We recommend prioritising the following steps:

(i) Establish a written usage and monitoring policy: Rules governing work-related and private use of email, corporate messaging and similar systems should be expressly documented, together with the circumstances and limits of monitoring, the avoidance of continuous surveillance and the applicable monitoring procedures. The policy should be communicated to employees in an accessible and understandable manner.

(ii) Update privacy notices: The employee privacy notice and relevant internal policies should be aligned with the monitoring methods actually used. They should specify the lawful basis, categories of personal data processed, conditions of access, retention periods, data subject rights and, where relevant, categories of recipients. Evidence that the relevant information and privacy notices have been provided should be retained.

(iii) Adopt a graduated review procedure: Upon receiving a report of suspected misconduct or an incident, the legitimate purpose and factual basis of the proposed monitoring should first be documented. Less intrusive options, such as technical controls and narrowly targeted traffic or log reviews, should be considered. Access to content should occur only where it can be explained why these measures are insufficient and why access is necessary, and should be subject to a predefined approval and legal review process.

(iv) Implement access controls and data security measures: The persons authorised to approve monitoring, conduct reviews and access findings should be identified. Role-based access controls, audit logs, confidentiality obligations and retention and deletion rules should be implemented. Safeguards should be designed to prevent unnecessary viewing of correspondence unrelated to the purpose of the review and of third parties’ personal data.

(v) Reassess employee offboarding procedures: A separate procedure should govern deactivation of a departing employee’s mailbox, the need for automatic replies or forwarding, any access required for business continuity, archiving and retention periods. Access that is limited to a demonstrated need and properly logged should be preferred over granting another employee unrestricted access to the mailbox.

(vi) Document monitoring decisions: For each case, the source of the suspicion, the purpose of monitoring, why alternative measures would be inadequate, the categories of data to be accessed, the relevant date range, authorised persons and the retention and deletion plan should be recorded. This will help ensure that the necessity and proportionality of the decision can be assessed retrospectively.

5. CONCLUSION AND ASSESSMENT

The Principle Decision does not entirely preclude employers from monitoring communications for the purposes of conducting business, maintaining information security or protecting legitimate interests. However, having technical control over a corporate email account or communication system does not confer an unconditional legal right to monitor correspondence. Lawfulness depends on the combined fulfilment of adequate prior information, a valid lawful basis, a concrete and legitimate purpose, graduated monitoring, proportionality and effective data security measures.

Where practices contrary to the Principle Decision are identified, administrative measures may be imposed under Article 18 of the KVKK, depending on the circumstances. Existing practices involving content review or systematic monitoring of employee activities should therefore be reassessed in particular.

We wish to emphasise that the criteria of graduated monitoring, concrete suspicion, necessity and proportionality set out in the Principle Decision must be assessed in light of the specific circumstances of each case. Whether monitoring can be limited to traffic or log data, at what stage and to what extent access to correspondence content is permissible, or by what method a former employee’s account may be reviewed cannot be conclusively determined through a single general rule. Therefore, where a situation arises that may require monitoring or reviewing communication content, we recommend obtaining an assessment from the legal department or external legal counsel before initiating any monitoring activity, so that its lawful basis, necessity, scope and method can be determined on a case-by-case basis.

Av. Ece Akbaba