A new policy decision issued by the Personal Data Protection Authority (PDPA) of Türkiye was published in the Official Gazette on 8 October 2026. Under the policy decision (Decision Date: 16 September 2026, No. 2026/2035), the PDPA sets out the key principles and requirements governing employers’ monitoring of corporate communication channels.
The decision states that a fair balance must be maintained between the employer’s managerial authority and employees’ rights protected under Articles 20 (privacy of private life and protection of personal data) and 22 (freedom of communication) of the Constitution.
Accordingly, employers should consider the following principles to ensure that the processing of personal data arising from the monitoring of corporate email accounts and other communication channels used by employees for business purposes complies with Law No. 6698 (the Law) and the applicable legislation:
Prohibition of Unlimited Monitoring: The fact that communication tools are owned by the employer or used in the workplace does not grant the employer unlimited authority to monitor employees’ communications. The general principles and obligations set forth under the Law remain applicable.
Business and Private Use: When determining the scope of monitoring, employers should consider the purpose for which the communication tool was provided and the applicable rules governing its use. A clear distinction should be made between business and private use.
Rules on Private Use: Employers may establish rules governing the private use of workplace communication tools, provided that such rules are clear, understandable, and communicated to employees. Even where private use is prohibited, monitoring remains subject to the principle of proportionality. Where business and private use cannot be clearly distinguished, the scope of the employer’s monitoring authority should be interpreted more narrowly.
Distinction Between Technical and Legal Access: The technical ability to access a device or system does not, in itself, confer legal authority to access an employee’s personal accounts or correspondence falling within the scope of private communications.
Prior Notification: General and prior notifications merely stating that employees’ emails may be monitored are insufficient. Employees must be provided with specific information, in compliance with Article 10 of the Law, regarding the purpose, scope, method and legal basis of the monitoring.
Limitations on Explicit Consent: Due to the dependency and imbalance of power inherent in the employment relationship, explicit consent cannot, as a rule, be regarded as the primary legal basis for email monitoring.
General Principles and Proportionality: Monitoring activities must comply with the general principles under Article 4 of the Law, including lawfulness, good faith, specific and legitimate purposes, and necessity and proportionality. Personal data collected through monitoring should not be retained longer than necessary for the relevant processing purpose.
Graduated Monitoring: Monitoring should be conducted progressively. Where the employer can achieve a legitimate purpose through a less intrusive method, a more intrusive form of monitoring should not be used.
Sensitive and Third-Party Data: Monitoring should account for sensitive personal data under Article 6 of the Law and personal data relating to employees’ correspondents or other third parties.
Access Restrictions: Access to the relevant data must be restricted to specifically authorized personnel, and access logs must be maintained.
Termination of Employment: Following termination, the legal basis for processing data from an employee’s corporate email account must be separately assessed. Termination does not justify indefinite access to or processing of such data.
The PDPA’s decision further provides that any person acting in contravention of these principles may be subject to administrative fines and other administrative sanctions pursuant to Article 18 of the Law.
