PDP BOARD PRINCIPLE DECISION ON MONITORING CORPORATE E-MAIL AND COMMUNICATION CHANNELS
The Principle Decision of the Personal Data Protection Board dated 16 September 2026 and numbered 2026/2035, published in the Turkish Official Gazette dated 8 October 2026 and numbered 33394, sets out the procedures and principles for employer monitoring of corporate e-mail accounts and other communication channels used for business. The Decision seeks to balance the employer’s managerial authority with employees’ rights to privacy, protection of personal data and freedom of communication.
Employer Ownership Does Not Create Unlimited Monitoring Authority
The Board states that monitoring corporate e-mail and other business communication channels constitutes personal data processing. Ownership of the communication tool or its use in the workplace does not give the employer unlimited authority to monitor employees’ communications. Monitoring must comply with the processing conditions and general principles under Personal Data Protection Law No. 6698, together with applicable transparency and data security obligations.
Business Use, Private Use and Technical Access Must Be Distinguished
The scope of monitoring should reflect the purpose for which the tool was allocated and the applicable usage rules. Rules on private use must be clear, understandable and known to employees. Even where private use is prohibited, monitoring remains subject to proportionality. An employer’s technical ability to access a device, network or corporate system also does not mean that it may freely access an employee’s personal e-mail, instant messaging, social media or other private communication space. Technical accessibility and legal authority to access must be distinguished.
Employees Must Be Informed in Advance and Properly Provided with a Privacy Notice
The privacy notice should clearly state the legal basis, purpose, scope and method of processing; when communication content may be accessed; the retention period; and employees’ rights under Article 11 of the Law. A general statement that “corporate e-mail may be monitored by the employer” is not sufficient by itself. Given the imbalance of power in employment relationships, explicit consent is also not automatically the primary legal basis in every case, and valid consent or another processing condition does not grant unlimited monitoring authority.
Monitoring Must Be Proportionate and Graduated
Monitoring must serve specified, explicit and legitimate purposes and be relevant, limited and proportionate. Where a legitimate objective can be achieved through a less intrusive method, a more intrusive method should not be used. As a rule, review of communication content should occur only where there is a concrete suspicion or a legitimate purpose linked to a specific incident, and only to the extent required by that purpose. Broad, undefined and continuous content review should be avoided.
Data Security, Sensitive Data and Termination of Employment
Content review may reveal special categories of personal data and personal data relating to third parties. Access to data obtained from corporate communication channels should be restricted to a limited number of duly authorized personnel, access activities should be logged and confidentiality obligations should be secured. After termination of employment, the legal basis for processing data in the former employee’s corporate e-mail account must be assessed separately; termination does not mean that such data may remain accessible or be processed indefinitely.
Key Practical Actions for Employers
Employers should review their policies on the use and monitoring of corporate communication tools, employee privacy notices, monitoring purposes and methods, retention periods, access authorizations and access logs in line with the Principle Decision. Circumstances requiring content review should be defined narrowly and less intrusive methods should be preferred where possible. The Board states that, where non-compliance is identified, it may examine the circumstances of the case and take action against the relevant data controller under Article 18 of the Law.
