16/10/2026
PERSONAL DATA PROTECTION IN THE MONITORING OF EMPLOYEES’ CORPORATE COMMUNICATION CHANNELS: PRINCIPLE DECISION NO. 2026/2035 OF THE PERSONAL DATA PROTECTION BOARD
Introduction
The Principle Decision on the Procedures and Principles to Be Observed in Personal Data Processing Activities Carried Out Through the Monitoring of Communication Channels Used for the Performance of Work, Primarily Corporate E-Mail Accounts Allocated to Employees by Employers dated 16 September 2026 and numbered 2026/2035 (the “Principle Decision”), adopted by the Personal Data Protection Board (the “Board”), was published in the Official Gazette dated 8 October 2026 and numbered 33394.
The monitoring of employees’ communication channels, which has given rise to judicial precedents established by numerous higher courts, particularly the Constitutional Court, has ultimately culminated in the Board’s adoption of a Principle Decision.
The Principle Decision sets out the legal principles that employers must observe when monitoring corporate e-mail accounts allocated to employees and other communication channels used for the performance of work. Emphasising the need to strike a fair balance between the employer’s managerial authority and the employee’s right to privacy, right to the protection of personal data, and freedom of communication, the Board has underlined that such monitoring constitutes personal data processing activities subject to assessment under Law No. 6698 on the Protection of Personal Data (the “Law”).
Fundamental Principles
The key issues addressed in the Principle Decision are examined below.
- Legal Framework Governing Monitoring Activities
Monitoring conducted through corporate e-mail accounts and other communication channels allocated to employees cannot be assessed solely within the scope of the employer’s managerial authority. The fact that communication tools belong to the employer or have been allocated for the performance of work does not permit the unrestricted examination of employees’ communications. Accordingly, monitoring activities must be carried out in compliance with the personal data processing conditions and general principles set forth in the Law. Where necessary, the obligation to inform must be fulfilled, and technical and organisational measures must be implemented to ensure the security of personal data.
- Distinguishing Between Business and Personal Use
When determining the limits of monitoring, consideration must be given to the purpose for which the communication tool was allocated, the conditions governing its use, and whether employees are permitted to use it for personal purposes. The employer’s authority to prohibit personal use or subject it to specific rules must be exercised within the framework of clear and comprehensible arrangements communicated to employees in advance.
Nevertheless, even where personal use is prohibited, the employer’s monitoring authority does not thereby become unlimited. Where business and personal communications can be distinguished, personal correspondence must be excluded from monitoring. Where such a distinction cannot be made, the scope of monitoring must be defined more narrowly.
- Separate Assessment of Technical Access and Legal Authority
The employer’s technical ability to access a device, network, or corporate system does not, in itself, confer the legal authority to examine all communication content accessible through those systems. Accordingly, access to correspondence contained in an employee’s personal e-mail account, instant messaging application, social media account, or other similar private communication environment must be assessed from a legal perspective independently of its technical accessibility. When determining the limits of monitoring, the technical ability to access such communications and the existence of the legal grounds legitimising that access must be assessed separately.
- Prior Notification and the Obligation to Inform
Informing employees in advance of the existence, scope, and method of monitoring is significant in assessing the lawfulness of the interference. However, the notification required under the case law of the Constitutional Court and the obligation to inform prescribed under Article 10 of the Law constitute distinct legal requirements. For the purposes of fulfilling the obligation to inform, the purpose and legal basis of the personal data processing activity, its scope and method, the circumstances under which communication content may be accessed, the data retention period, and the rights of data subjects under Article 11 of the Law must be specified in a clear, comprehensible, and concrete manner. General statements merely indicating that corporate e-mail accounts may be monitored may be insufficient to satisfy the requirements of prior notification and the obligation to inform, depending on the circumstances of the particular case.
- Assessment of Explicit Consent as a Legal Basis
The dependency inherent in the employment relationship and the imbalance of power between the parties are of particular importance when assessing the validity of explicit consent obtained from employees. Accordingly, explicit consent cannot, in every case, be regarded as the primary legal basis for monitoring employee communications. Where explicit consent is relied upon, whether it was given freely and voluntarily must be assessed in light of the circumstances of the particular case.
Although monitoring may be based on one of the other personal data processing conditions prescribed under the Law, the existence of the relevant condition does not, in itself, confer unlimited monitoring authority upon the employer. Monitoring must also pursue a specific, explicit, and legitimate purpose and be relevant, limited, and proportionate to that purpose.
- Graduated Monitoring and the Principle of Proportionality
The Board emphasises that the degree of interference involved in monitoring activities must be proportionate to the purpose pursued. Where the employer can achieve its legitimate purpose through less intrusive methods, more extensive monitoring methods should not be employed. In this regard, the examination of traffic and log records must be distinguished from access to communication content. Content monitoring should be undertaken only where its necessity has been established in light of the circumstances of the particular case. General, indeterminate, and continuous examinations of communication content must be avoided, and monitoring must be conducted in connection with a specific incident or concrete suspicion.
- Ensuring the Security of Personal Data During Monitoring
The possibility that special categories of personal data belonging to employees or third parties may be obtained during the examination of communication content must be taken into account. Data protection obligations must also be observed in respect of the personal data of other individuals contained in employees’ correspondence. Access to data obtained as a result of monitoring must be restricted to a limited number of personnel authorised by virtue of their duties and responsibilities. Defining access privileges in accordance with job descriptions, keeping records of access activities, and ensuring that authorised personnel are bound by confidentiality obligations are important measures for safeguarding data security.
- Procedures Following the Termination of Employment
The termination of the employment relationship does not justify keeping the corporate e-mail account allocated to an employee, or the personal data contained therein, accessible or available for processing indefinitely. The legal basis for any data processing activities carried out at this stage must be assessed separately. Accordingly, the legal necessity of actions such as accessing the account and retaining the data following termination of employment must be established, and both the scope of access and the retention period must be limited to what is necessary to satisfy those requirements.
Conclusion and Assessment
The Board’s Principle Decision No. 2026/2035 establishes that an employer’s authority to monitor corporate communication tools allocated to employees cannot be assessed independently of its obligations concerning the protection of personal data. Monitoring activities carried out within the scope of the employer’s managerial authority must be subject to an assessment of lawfulness that takes into account the purpose, scope, and intensity of the interference with the employee’s fundamental rights and freedoms.
In this regard, employers should review their existing communication and information security policies, privacy notices provided to employees, and monitoring procedures in light of the Principle Decision. Monitoring activities must be based on rules established in advance, employees must be duly informed, less intrusive methods must be prioritised, and access activities must be recorded. These constitute fundamental elements of a lawful monitoring framework.
Where non-compliance with the obligations set forth in the Principle Decision is identified, action may be taken against data controllers pursuant to Article 18 of the Law, taking into account the circumstances of the particular case.
The relevant Principle Decision may be accessed through the following link:
https://www.resmigazete.gov.tr/eskiler/2026/10/20261008-6.pdf
Çelikbaş Law Office