1. Introduction and Legal Nature of the Decision
The Personal Data Protection Board (the Board), through its Principle Decision dated 16 September 2026 and No. 2026/2035, set out the procedures and principles that employers must follow when monitoring communication channels used for work, especially corporate email accounts provided to employees. The decision entered into force upon its publication in the Official Gazette dated 8 October 2026 and numbered 33394.
Adopted under Article 15(6) of the Personal Data Protection Law No. 6698 (the Law), this decision is not limited to resolving an individual dispute. It is a principle decision that sets out general rules binding on all employers acting as data controllers, with the aim of preventing violations commonly seen in practice. Its main purpose is to establish clear legal rules, within the principles of the Law, to balance the employer's property and management rights in the workplace with the employee's right to request the protection of personal data under Article 20 of the Constitution and freedom of communication protected under Article 22 of the Constitution.
2. Scope of the Decision and Communication Channels Subject to Monitoring
The Principle Decision states that monitoring rules are not limited to traditional corporate email accounts but cover all digital communication systems used in the workplace for business purposes. The following channels are directly covered by the decision:
The Board stated that, for such applications that may also be used for personal purposes, it is necessary to assess separately, based on the facts of each case, whether the employer provided the account for work, whether the employee uses it through a personal account, and the employee's legitimate expectation of privacy.
3. Main Legal Principles and Conditions for Monitoring Set Out in the Decision
The Board did not consider the employer's power to monitor communication channels to be an absolute or unlimited right. The fact that the employer owns the communication tools or has technical control over devices and servers through system administrator (admin) access does not give the employer an unrestricted right to monitor. The technical ability to access data does not, by itself, create legal authority.
The main conditions and binding rules identified in the Board's decision for lawful monitoring are as follows:
When corporate email accounts are monitored, even processing only traffic and log records without accessing the content of messages is, in itself, an act of personal data processing. Whether monitoring concerns traffic data or content data, it must always comply with the general principles in Article 4, the conditions for processing in Articles 5 and 6, the obligation to inform in Article 10, and the data security provisions in Article 12 of the Law.
When defining the scope of monitoring, a distinction must be made between business use and personal use based on the purpose of workplace communication tools. The employer may set rules on personal use as part of its management rights. However, these rules must be clear, understandable, available for employees to know, and clearly communicated to them:
The employer's technical access to a particular device, session, network, or corporate system does not mean that it may freely access the content of correspondence in an employee's personal email account, personal instant messaging application, social media inbox, or similar private communication space. The technical ability to access information and the legal authority to access it must be clearly distinguished.
The prior notice required under the case law of the Constitutional Court and the obligation to inform under Article 10 of the Law are not exactly the same. Not every notice meets the obligation to inform under the Law. However, a proper privacy notice containing the elements required by Article 10 also meets the requirement of prior notice.
Given the employee's dependent position within the employment relationship and the imbalance of power between the parties, the employee's explicit consent generally cannot be treated as the primary legal basis for email monitoring. Where explicit consent is used, whether it was given freely must be assessed separately based on the facts of the case.
Monitoring must follow a step-by-step approach. If the employer can achieve its legitimate aim by a less intrusive method, it may not use a more intrusive monitoring method. If misuse of communication tools provided to employees can be prevented through technical measures (such as filtering or blocking), this does not give the employer a general right to monitor.
When monitoring content, the risk of processing special categories of personal data (such as health data or trade union membership) within the meaning of Article 6 of the Law, in the body or attachments of a monitored message, must be considered. In addition, because correspondence often contains personal data belonging to recipients, the effect of monitoring on third parties' data must also be taken into account.
Monitoring through covert methods without prior notice to the employee, or through tools that record all employee activities without distinction (such as keyloggers or continuous screen recording), is unlawful. Monitoring must take place with the employee's knowledge and within a predictable framework.
Access to data obtained through communication channels must be limited to a small number of staff authorised for this task. Access rights must be defined by job descriptions, access logs must be kept in full, and persons accessing the data must be subject to confidentiality obligations.
After the employment relationship ends, the legal basis for processing data relating to the corporate email account provided to the employee must be assessed separately.
4. Conclusion and Assessment
The Personal Data Protection Board's Principle Decision No. 2026/2035 makes the monitoring of corporate communication channels in workplaces subject to binding personal data compliance rules for all employers, rather than treating it only as a matter of management or technical control. The Board protected the employee's freedom of communication and right to privacy against the employer's property and management rights. It limited monitoring powers through the principles of transparent notice, step-by-step monitoring and proportionality, and clearly established that technical access does not create legal authority.
This decision, which is a general rule for all data controllers, requires privacy notices and internal monitoring, disciplinary and information security policies to be reviewed against specific criteria. Monitoring that does not comply with the required procedures and principles may result in administrative sanctions imposed by the Board, as well as the risk that records obtained will be treated as unlawfully obtained evidence in employment litigation and may lead to criminal liability. In this context, employers should restructure their monitoring processes around preventive measures, step-by-step review methods and transparent privacy notices.
Türkçe 