Türkiye's data protection board sets limits on employer monitoring of work email

Türkiye's Personal Data Protection Board has issued a principle decision setting the rules employers must follow when they monitor corporate email accounts and other channels used for work, after complaints that such monitoring breached the country's data protection law. Decision No. 2026/2035, dated 16 September, was published in the Official Gazette on 8 October, and its text is on the website of the Personal Data Protection Authority (KVKK).

The decision applies Law No. 6698 on the Protection of Personal Data to workplace monitoring. It says that where the obligations are not met, the Authority will examine the facts of each case and act against the data controllers concerned under Article 18 of the Law, which sets out misdemeanours and administrative fines.

What the Board found

The Board's examinations found that employees' communication channels, and corporate email accounts in particular, were being monitored, that the content of correspondence was being accessed, that traffic and log records were being examined, that filtering or routine inspections were in use, and that the data obtained were used in disciplinary and dismissal proceedings, according to the decision. Employees had not been informed of this processing in an adequate, clear and concrete way, the Board found.

The decision describes a corporate email account as more than a communication tool: it is a data source holding information about the employee's professional and sometimes personal network, working patterns, communications and the content of correspondence. Monitoring it requires a fair balance between the employer's rights under the employment contract and its right of management, and the employee's rights to privacy, to the protection of personal data and to freedom of communication under Articles 20 and 22 of the Constitution, the Board says.

The rules employers must follow

The decision sets out the following points, according to the text published by KVKK:

• Ownership is not a licence. The fact that a communication tool belongs to the employer, or is used at the workplace, does not give the employer unlimited power to inspect employees' communications.
• Work and private use must be distinguished. Employers may set rules on private use, but the rules must be clear and knowable to staff, and even where private use is banned, monitoring is limited by proportionality. Where work and private use cannot be clearly separated, the scope of monitoring should be read more narrowly.
• Technical access is not legal access. Being able to reach a device, session or network does not entitle an employer to read an employee's personal email, messaging apps or social media accounts.
• General notices are not enough. Telling staff only that the corporate account may be monitored will not necessarily amount to prior notice, and does not by itself discharge the duty to inform under Article 10 of the Law. A proper notice should state the legal basis, purpose, scope and method of processing, when content may be accessed, how long data are kept and the employee's rights under Article 11.
• Consent is rarely the right basis. Given the dependency and imbalance of power in employment, explicit consent cannot as a rule be treated as the primary legal basis for email monitoring, and valid consent does not give unlimited monitoring power either.
• Monitoring must be graduated. Where a less intrusive method would achieve a legitimate aim, a heavier one should not be used. Content should be examined only where there is a concrete suspicion or a legitimate aim linked to a specific incident, and general, open-ended and continuous content review should be avoided.
• Third parties and sensitive data count. Content and attachments may contain special categories of personal data under Article 6, and the people on the other side of an employee's correspondence also have data at stake.
• Access must be restricted and logged. Only a limited number of authorised staff should access the data, access records should be kept, and confidentiality obligations secured. The end of employment does not make an account's data indefinitely accessible.

The decision also distinguishes between the notice that the Constitutional Court's case law requires before monitoring and the duty to inform under Article 10 of the Law, saying that not every notice meets the statutory test, while a notice that meets Article 10 and is clear about the monitoring's purpose, scope and method can satisfy the prior-notice requirement, the Board says.

The decision is the second principle decision this year on workplace data. In April the Board issued Decision No. 2026/921 on processing biometric data for tracking working hours, and on 10 September the Authority published a public announcement on requests for its opinion on that decision, according to a KVKK notice. The Authority's homepage also lists a webinar on 2026 principle decisions and public announcements, held in October.

For multinational employers with Turkish operations, the practical question is whether group-wide policies that rely on blanket monitoring clauses or employee consent meet these tests. The Board says it will judge each complaint on its specific facts.