The Personal Data Protection Board’s Principle Decision on Employers’ Monitoring of Corporate Email Accounts and Business Communication Channels (“Principle Decision“) was published in the Official Gazette No. 33394 on 8 October 2026. Issued on 16 September 2026 and numbered 2026/2035, the Principle Decision establishes the procedures and principles that employers must comply with when monitoring corporate email accounts allocated to employees and communication channels used for business purposes. It emphasizes that the ownership of communication tools by the employer does not confer unlimited monitoring authority, setting out strict rules regarding prior notification, proportionality, the exceptional nature of content review, and data access restrictions.
The scope of the Principle Decision extends beyond corporate email accounts to internal messaging applications, corporate instant messaging accounts, customer relationship or request management systems, and chat or recording areas on meeting platforms, depending on the specific circumstances. In applications suitable for personal use, factors such as whether the account was allocated for business use, whether the employee uses a personal account, and the employee’s reasonable expectation of privacy must be taken into account. The employer’s technical capability to access a system does not authorize them to access correspondence in an employee’s personal email account, personal messaging apps, or social media inboxes.
The Board clarified that examining traffic or log records alone constitutes personal data processing. Therefore, all monitoring activities must comply with Personal Data Protection Law No. 6698 (“Law“). Given the inherent power imbalance in employment relationships, the Board stated that an employee’s explicit consent should not be relied upon as the primary legal basis. Instead, depending on the case, employers may rely on conditions such as compliance with a legal obligation, establishment or protection of a right, or legitimate interests—though these do not grant unlimited authority.
The Principle Decision introduces key principles regarding monitoring activities:
• Prior Notification and Provision of Information: Information provided to employees must not be generic; it must clearly set out the legal basis, purpose, scope, monitoring methods, content access conditions, retention periods, and employee rights under the Law.
• Distinction Between Business and Personal Use: Prohibitions or restrictions on personal use must be clear and known. Where personal use is permitted and business communications can be distinguished, monitoring must be strictly limited to business communications.
• Gradual and Proportionate Monitoring: Less intrusive methods must be preferred over more intrusive ones. If a violation can be proven through non-content elements, accessing correspondence content is unnecessary and disproportionate.
• Exceptional Nature of Content Monitoring: Access to content is only permissible in exceptional cases where traffic data monitoring is insufficient, requiring a specific suspicion, a concrete legitimate justification, and strict limitation to the allegation.
• Avoidance of Covert and Continuous Monitoring: Secret monitoring without prior notice and continuous, uninterrupted surveillance are deemed unlawful and disproportionate.
• Data Security and Access Restrictions: Data obtained must be restricted to a limited number of authorized personnel based on job descriptions, protected by access logs, and handled under strict confidentiality obligations.
The Principle Decision also addresses practices following the termination of employment. As a rule, accounts must be disabled for active use, incoming messages from unrelated persons must be prevented, and personal data without a lawful processing basis must be destroyed. Practices like email forwarding, auto-replies, or archiving for business continuity must be limited in scope and duration.
Where non-compliance is identified, investigations will be conducted and administrative actions will be taken against data controllers under Article 18 of the Law. Accordingly, employers are advised to review their communication tool policies, privacy notices, content review procedures, and post-termination practices.
The full text of the Principle Decision is available at the following link: https://www.resmigazete.gov.tr/eskiler/2026/10/20261008-6.pdf
Kind regards,
Balay, Eryiğit & Erten Attorney Partnership
