The Personal Data Protection Board (“Board”), through its Principle Decision dated 16 September 2026 and numbered 2026/2035, published in the Official Gazette dated 8 October 2026 and numbered 33394 (“Principle Decision”), established the procedures and principles governing employers’ monitoring of corporate email accounts allocated to employees and other communication channels used for business purposes. The Principle Decision clarifies the legal basis for monitoring activities, notification obligations towards employees, the limits of monitoring, and obligations concerning the management of accounts following the termination of employment.
Limits of Employers’ Monitoring Powers
Under the Principle Decision, employers may monitor communications in the exercise of their managerial prerogative. However, such monitoring must respect employees’ right to the protection of their personal data and freedom of communication. Monitoring must serve a legitimate purpose, and any interference must be proportionate.
Referring to the relevant judgments of the Constitutional Court and the European Court of Human Rights, the Principle Decision states that even the examination of traffic or transaction logs without accessing the content of correspondence constitutes a personal data processing activity, and that monitoring content requires “stronger justification”. Accordingly, these activities are subject to the fundamental principles, lawful bases for processing, notification duties and data security obligations under Personal Data Protection Law No. 6698 (“Law”). Employers’ ownership of communication tools does not confer unrestricted monitoring powers.
Key Principles Governing Monitoring
The Board emphasised that a corporate email account allocated to an employee is more than a communication tool: it is a source of data containing the employee’s professional and, at times, personal network, working patterns and correspondence. Under the Principle Decision, employers must pay particular attention to the following when exercising their monitoring powers:
- Prior and Specific Notification: Employees must be clearly informed of the legal basis, purpose, scope and method of monitoring, the circumstances in which content may be accessed, the retention period and their rights under the General statements indicating that an account may be monitored are insufficient.
- Appropriate Legal Basis: Given the imbalance of power in the employment relationship, an employee’s explicit consent should not, as a rule, be treated as the primary legal Depending on the circumstances, processing may rely on the lawful bases relating to compliance with a legal obligation, the establishment, exercise or protection of a right, or legitimate interests.
- Limits on Personal Use: Rules governing the personal use of communication tools must be clearly communicated. Where personal use is permitted and business communications can be distinguished from personal communications, monitoring must be limited to business communications. The technical ability to access an employee’s personal accounts does not, in itself, provide a legal basis for such
- Graduated and Proportionate Monitoring: Priority must be given to less intrusive methods. Content monitoring may only be undertaken in exceptional circumstances where examining traffic data is insufficient and access to content is necessary. Such monitoring must be based on specific grounds for suspicion and limited to the allegation in question.
- Data Security: Access must be restricted to a limited number of personnel authorised on the basis of their duties; access logs must be maintained, and confidentiality must be ensured. Particular consideration must also be given to special categories of personal data and third-party personal data contained in correspondence.
- Unlawful Monitoring Practices: Monitoring through covert methods of which employees have not been informed in advance, or through tools that indiscriminately record all their activities, is unlawful. Accordingly, practices such as monitoring employees’ correspondence or recording their computer activities without their knowledge must be avoided. Monitoring must be carried out with the employee’s knowledge and within a foreseeable framework whose scope and methods have been explained in advance.
Distinction Between the Obligation to Inform and Prior Notification
The Principle Decision emphasises that notifying employees in advance of monitoring and fulfilling the obligation to inform under the Law are distinct requirements. A duly provided privacy notice containing the information required under Article 10 of the Law, together with clear information on the purpose, scope and method of monitoring, may also satisfy the prior notification requirement. Conversely, a general notification that does not contain the mandatory elements of a privacy notice does not constitute fulfilment of the obligation to inform under the Law.
Termination of Employment
Following the termination of employment, the legal basis for processing data associated with a corporate email account must be assessed separately. As a rule, the account must be closed to the employee’s active use and further access, messages must be protected against access by unrelated persons, and data for which a legal basis no longer exists must be destroyed. Depending on the circumstances, forwarding, automatic replies, archiving or retention may be considered for the purposes of ensuring business continuity, maintaining corporate communications, exercising the right of defence in legal disputes or fulfilling statutory obligations. Such measures must be limited in scope and duration, access permissions must be defined, and the measures must be documented.
Conclusion and Assessment
The Principle Decision emphasises that employers’ monitoring powers do not confer an unrestricted right to monitor and access employees’ data. In this context, the principal effect of the Principle Decision may be summarised as clarifying the limits of employers’ powers to monitor communication channels, explaining the requirements for informing employees and providing prior notification, and setting out the obligations concerning the management of corporate email accounts following the termination of employment.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
