1. Introduction
The Turkish Personal Data Protection Board’s (“Board”) Principle Decision on the Procedures and Principles to Be Followed When Monitoring Communication Channels Used for the Performance of Work, Particularly Corporate Email Accounts Assigned to Employees by Employers (“Decision”) is published in the Official Gazette dated 8 October 2026 and numbered 33394.
The Board notes that the communication channels used in the workplace are not limited to corporate email accounts. Internal messaging applications, corporate instant messaging accounts, customer relationship or request management systems, and the chat and recording features of meeting platforms may also be subject to monitoring, depending on the circumstances of the specific case. At the same time, the Board stresses that the fact that a communication tool belongs to the employer, or is used in the workplace, does not give the employer unlimited authority to monitor employees’ communications.
2. Compliance of Monitoring-Based Personal Data Processing with the TR DPL
In its examinations, the Board found that employers monitored the communication channels assigned to employees, and corporate email accounts in particular. They accessed the content of correspondence, reviewed traffic and log records relating to communications, and carried out filtering or routine monitoring. The data obtained was then used in disciplinary proceedings or in processes leading to the termination of employment contracts. However, employees had not been informed about these processing activities in a sufficient, clear, and concrete manner.
Against this background, the Board stated that the following points must be taken into account for personal data processing carried out through the monitoring of communication channels used for the performance of work, particularly corporate email accounts assigned to employees, to comply with the TR DPL and the relevant legislation:
- Compliance of the processing activity with the TR DPL: Monitoring corporate email accounts constitutes personal data processing even where only traffic/log records are processed and the content is not accessed. This processing is subject to the TR DPL’s processing conditions, general principles, obligation to inform, and data security.
- Determining the scope of monitoring with regard to “business use” and “personal use”: In determining the scope of monitoring, the purpose for which the communication tool was assigned and the rules governing its use must be taken into account. Whether personal use is prohibited or has not been expressly regulated may lead to different outcomes in assessing the lawfulness of the monitoring.
- Setting rules on personal use: Under its managerial rights, the employer may set rules on the personal use of workplace communication tools. These rules must, however, be clear, understandable, and accessible to the employee. Even where personal use is prohibited, the employer’s monitoring authority remains limited by the principle of proportionality. Where business use and personal use cannot be clearly separated, the scope of the monitoring authority must be construed more narrowly.
- Separating technical access authority from legal access authority: The fact that an employer has technical access to a particular device, session, network, or corporate system does not mean it may freely access the content of correspondence in the employee’s personal email account, personal instant messaging application, social media account, or similar private communication spaces.
- Informing employees about monitoring in advance: Informing employees in advance about the monitoring to be carried out is one of the key factors in determining whether the monitoring is lawful.
- Scope of the employer’s disclosure: The employer’s disclosure must set out, in a clear, understandable, and concrete manner, (i) the legal basis, (ii) the purpose, (iii) the scope and method of the processing activity, (iv) the circumstances in which communication content may be accessed, (v) the retention period of the data, and (vi) the data subjects’ rights under Article 11 of the TR DPL.
- Insufficiency of general notices: Merely notifying employees in general terms that the employer may monitor the corporate email account will not, depending on the circumstances, be sufficient as prior notice. Nor does it automatically mean that the disclosure obligation under Article 10 of the TR DPL has been fulfilled.
- Employee’s explicit consent should not be the primary legal basis for email monitoring: Given the dependency inherent in the employment relationship and the imbalance of power between the parties, an employee’s explicit consent cannot, as a rule, be accepted as the primary legal basis for email monitoring in every case. Where explicit consent is relied upon, whether it was given freely must be assessed separately in light of the circumstances of the specific case.
- Conducting monitoring in line with the general principles and proportionately: Monitoring activities must be carried out in accordance with the general principles set out in Article 4 of the TR DPL. That is, they must comply with the law and the rule of good faith, serve specific, explicit, and legitimate purposes, and be limited, proportionate, and connected to those purposes. The personal data obtained must not be retained for longer than necessary for the purpose of processing.
- Graduated monitoring: Where the employer can achieve its legitimate aim by a less intrusive method, it must not resort to a more intrusive monitoring method.
- Conditions for content monitoring: Because it is the most intensive interference with the employee’s private life and freedom of communication, content monitoring requires a stronger and more concrete legitimate justification. It may be used only where there is concrete suspicion and must be limited to the allegation concerned. Content reviews that are vague in scope, general, or continuous must be avoided.
- Special categories of personal data and third-party data: In content monitoring, it must be borne in mind that the content reviewed, or its attachments, may contain special categories of personal data under Article 6 of the TR DPL. In addition, since employees’ communications often contain personal data of the other parties to the communication or of other third parties, the effects the monitoring may have on those persons must also be considered.
- Access authorization and data security: Access to data obtained from corporate email accounts and other communication channels used for the performance of work must be restricted to a limited number of personnel who have been assigned the relevant duty and authority.
- Termination of the employment relationship: After the employment relationship ends, the legal basis for personal data processing activities concerning the corporate email account assigned to the employee, and the data obtained or held through that account, must be assessed separately. The termination of the employment relationship does not mean that such data may remain accessible or be processed indefinitely.
3. Conclusion
The Decision states that if the Board finds that the above obligations have not been complied with, it will carry out the necessary examinations and assessments in light of the circumstances of the specific case and take action against the data controllers concerned under Article 18 of the TR DPL. In this context, employers are advised to (i) review their monitoring practices, privacy notices, and internal policies regarding corporate email accounts assigned to employees and other communication channels used for the performance of work in line with the procedures and principles set out in the Decision, (ii) limit the scope of monitoring in accordance with the principle of proportionality, and (iii) ensure that the processes for informing employees are concrete and adequate.