The Personal Data Protection Board’s Principle Decision No. 2026/2035, dated September 16, 2026, was published in the Official Gazette No. 33394, dated October 8, 2026. The Decision sets forth, under sixteen headings, the procedures and principles that must be followed in personal data processing activities carried out through the monitoring of communication channels used for the performance of work, particularly corporate email accounts assigned to employees by employers. The Decision was adopted pursuant to the sixth paragraph of Article 15 and subparagraphs (e), (f), and (g) of the first paragraph of Article 22 of the Personal Data Protection Law No. 6698.

According to the Board’s findings, in practice, communication channels assigned to employees are monitored, the content of correspondence is accessed, traffic and log records are examined, filtering or routine monitoring practices are carried out, and the data obtained is used in disciplinary proceedings or in the termination of employment contracts; however, employees are not informed about these activities in a sufficient, clear, and concrete manner. The decision states that, in the event of a finding of non-compliance with these obligations, administrative proceedings will be initiated against the relevant data controllers pursuant to Article 18 of the Law.

Which Communication Channels Does the Policy Decision Cover?

The scope of the decision is not limited to corporate email accounts. The Board notes that internal messaging applications, corporate instant messaging accounts, customer relationship or request management systems, and chat and recording sections on meeting platforms may also be subject to audit as communication channels, depending on the specific circumstances of the case.

With regard to applications that are also suitable for personal use, the following factors will be evaluated separately: whether the account in question was assigned by the employer for business purposes, whether the employee is using their personal account, and the employee’s reasonable expectation of privacy.

The decision is based on the finding that a corporate email account assigned to an employee is more than just a communication tool; it serves as a data source containing the employee’s professional and, at times, personal network of contacts, work patterns, and the content of their correspondence. Monitoring these accounts constitutes a personal data processing activity that requires striking a balance between the employer’s management rights and the employee’s rights guaranteed under Articles 20 and 22 of the Constitution.

Points to Consider in Practice

• The processing of traffic and log records is, in and of itself, a personal data processing activity. Even when only traffic or log records are processed without accessing their content, the activity is subject to the general principles set forth in Article 4 of the Law, the processing conditions in Articles 5 and 6, the obligation to provide information under Article 10, and the data security obligations under Article 12.
• The fact that a communication device belongs to the employer does not grant unlimited monitoring authority. The mere fact that the device belongs to the employer or is located at the workplace does not, by itself, confer unlimited and absolute monitoring authority. The ruling, citing the case law of the Constitutional Court and the European Court of Human Rights, states that the authority to monitor is subject to the criteria of the employee being explicitly informed in advance, the monitoring being based on a legitimate purpose, being limited to that purpose and proportionate, and giving priority to less intrusive methods; it also notes that monitoring content requires a more compelling justification than monitoring traffic data.
• A distinction must be made between work-related and personal use. When determining the scope of monitoring, the distinction between “work-related use” and “personal use” based on the purpose of using workplace communication tools must be taken into account. Whether personal use is prohibited, permitted within certain limits, or not explicitly regulated may lead to different outcomes in assessing the legality of the monitoring.
• Even if personal use is prohibited, monitoring is limited by the principle of proportionality. The rules must be clear, understandable, and accessible to employees; if use is prohibited, restricted, or subject to specific time, scope, and method conditions, this must be clearly communicated. Conducting monitoring in the form of continuous and uninterrupted surveillance is not considered proportionate; in cases where a violation can be inferred from non-content-related elements, accessing the content of communications is not deemed necessary or proportionate. In cases where business-related and personal communications can be distinguished from one another, monitoring should be limited solely to business-related communications, and the employee’s personal communications should be excluded from monitoring.
• Technical access authority must be distinguished from legal access authority. The fact that an employer has technical authority over a specific device, session, network, or corporate system does not imply that the employer can freely access the content of communications in the employee’s personal email account, personal instant messaging application, social media inbox, or similar private communication spaces.
• Prior notification and the duty to provide information are not the same concepts. The notification required by the Constitutional Court’s case law is not exactly the same as the duty to provide information set forth in Article 10 of the Law. Not every instance of “notification” may constitute “disclosure” within the meaning of the Act; however, a proper disclosure that includes the elements stipulated in Article 10 and provides clear information regarding the purpose, scope, and method of the monitoring activity may also satisfy the requirement for prior notification of the employee.
• General notifications are insufficient. General statements such as “Corporate email accounts may be monitored by the employer” will not satisfy the prior notification requirement, nor will they constitute fulfillment of the obligation to provide information. The disclosure must go beyond abstract and general statements to specifically include the legal basis for the processing, its purpose, scope, whether monitoring will be conducted through the review of traffic and log records or through content monitoring, under what circumstances access to content will be granted, the retention period, and the data subject’s rights under Article 11.
• Explicit consent is not, as a rule, the primary legal basis. Given the relationship of dependency in an employment relationship and the power imbalance between the parties, explicit consent is generally not accepted as the primary legal basis for email monitoring. The ruling states that the processing activities covered by the monitoring may be based on subparagraphs (c), (e), and (f) of the second paragraph of Article 5 of the Law, depending on the specific circumstances of the case; however, it also notes that the existence of these conditions does not grant the employer unlimited monitoring authority.
• A graduated approach is fundamental to monitoring; covert monitoring is unlawful. Where the employer can achieve a legitimate purpose through a less intrusive means, a more intrusive monitoring method may not be employed. Access to content may only be considered in exceptional cases where monitoring traffic data is insufficient and access to content is necessary; where misuse can be prevented through technical means such as filtering or blocking, the employer does not have a general right to monitor. Monitoring conducted through covert surveillance methods of which the employee has not been informed in advance, or through tools that indiscriminately record all of the employee’s activities, shall be deemed unlawful.
• Content monitoring must be limited to specific grounds for suspicion. Since content monitoring constitutes the most intrusive interference with an employee’s private life and freedom of communication, it requires a stronger and more concrete legitimate justification. Content monitoring should be resorted to only in cases where there is concrete suspicion and should be limited to the scope of the allegation; monitoring that is vague, general, and ongoing should be avoided.
• Special categories of personal data and data belonging to third parties must be safeguarded. During content monitoring, the risk of processing special categories of personal data—as defined in Article 6 of the Law—in the body or attachments of the message being monitored must be taken into account. Furthermore, since communications often contain personal data belonging to recipients, the impact of monitoring on third-party data must also be considered.
• Access rights must be restricted and logged. Access to data obtained from corporate email accounts and other communication channels must be limited to a small number of employees specifically assigned to this task; access rights must be defined in job descriptions, access logs must be maintained, and individuals accessing the data must be bound by confidentiality obligations.
• The termination of an employment relationship does not grant indefinite access rights. As a general rule, the account must be closed to the employee’s active use and new access requests; incoming messages must not be viewable by unauthorized individuals; and personal data for which there is no longer a legal basis must be destroyed. However, to ensure business continuity, prevent disruptions to corporate communications, enable the exercise of the right to defense in legal disputes, or fulfill obligations arising from legislation, limited, time-bound, and access-authorized forwarding, auto-reply, archiving, or retention practices—all of which are documented—may be evaluated based on the specific circumstances of each case.

Recommended Steps for Data Controllers

• Compile an inventory of all communication channels used in the workplace (corporate email, internal messaging applications, corporate instant messaging accounts, customer relationship and request management systems, and the chat and recording sections of meeting platforms); determine whether audits are currently being conducted for each one and, if so, the method used to conduct them.
• Develop a written policy regarding the use of workplace communication tools; clearly specify whether personal use is permitted, restricted, or prohibited; outline any conditions regarding time, scope, and method, if applicable; and ensure these rules are communicated to employees in a manner that ensures they are aware of them.
• Updating the employee privacy notice; ensuring that the legal basis, purpose, and scope of the monitoring—whether it involves traffic and log monitoring or content monitoring—as well as the circumstances under which content will be accessed, the retention period, and the rights of data subjects are specifically outlined. Reviewing monitoring practices based on explicit consent to ensure they comply with the condition for lawful processing set forth in the second paragraph of Article 5 of the Law.
• The phased monitoring procedure must be documented in writing; it must specify at which stage traffic and log reviews will be conducted, under what specific circumstances content monitoring will be resorted to, who will make the decision, and how each stage will be documented.
• Identifying and terminating practices that constitute continuous and uninterrupted surveillance, as well as covert monitoring tools used without the employee’s knowledge; evaluating whether misuse can be prevented through less intrusive methods such as filtering or blocking, and documenting the outcome in writing.
• Restricting access permissions to communication data in accordance with job descriptions, maintaining access logs, and obtaining confidentiality agreements from personnel accessing the data; determining the retention period for data obtained during audits to be limited to the purpose of processing.
• Reviewing the procedures related to the termination of employment; ensuring that account closure, redirection, and automated response applications are time-limited and logged, and that data no longer having a legal basis is destroyed in accordance with the personal data retention and destruction policy.

You can access other announcements regarding the protection of personal data prepared by MC Legal on our Announcements page.