Turkey's data protection board has published a 16-article principle decision on monitoring corporate email and work communication channels. Covert monitoring is unlawful and content access becomes the exception.
Turkey's Personal Data Protection Board (KVKK) has published a principle decision setting out how employers may monitor corporate email accounts and the other communication channels used to run the business. Decision 2026/2035, dated 16 September 2026, appeared in the Official Gazette on 8 October 2026, issue 33394. It rests on Article 15(6) of Law No. 6698 and runs to 16 articles.
What the decision says
The Board's starting point is blunt: owning the device, the account or the line does not by itself grant unlimited audit powers. Even keeping traffic and log records alone counts as processing personal data and must satisfy the general principles of the Law.
- A graduated approach. Employers must choose the least intrusive method that achieves the purpose. Reading message content is exceptional and permitted only where traffic data is insufficient, where there is concrete suspicion, and only within the limits of that suspicion.
- Specific notice. A blanket line saying "corporate email may be monitored" is not enough. The notice must separately state the legal basis, purpose and scope; whether monitoring covers traffic data or content; when content may be accessed; the retention period; and the employee's rights.
- Covert monitoring is unlawful. Monitoring carried out without prior notice, and tools that record every action indiscriminately, are treated as unlawful. Continuous, uninterrupted monitoring is not considered proportionate.
- Personal accounts stay off limits. Administrator-level access to a device, session or network does not create a right to browse an employee's personal email, messaging apps or social media content.
- Accounts after departure. As a rule the account should be deactivated and incoming messages must not be visible to unrelated staff. Forwarding, auto-replies or archiving may be acceptable only where they are limited, time-bound, access-controlled and logged.
The scope reaches beyond email. Corporate messaging apps, CRM and ticketing systems, and the chat and recording features of meeting platforms all fall within the same framework. The Board also notes that, given the power imbalance in employment, explicit consent should not generally serve as the primary legal basis for monitoring.
What it means for smaller companies
In small and mid-sized businesses, email monitoring usually rests not on a written policy but on the technical access held by an in-house IT lead or an outside support provider. Opening a mailbox from an administrator account on the mail server is technically trivial; the decision clarifies the conditions under which it may be done. Leaving a departed employee's mailbox open indefinitely, running log-collection tools on their default settings, and adding a single line to a privacy notice are common habits that now carry compliance risk. Controllers that fall short may face administrative action under Article 18 of Law No. 6698.
What we recommend at Kamer Bilişim
- Write down what you actually do today. Who can reach which data in which system, and how long is each log kept? Build a single inventory covering the mail server, firewall, CRM and meeting platform. The specific notice the decision requires can only be drafted from that inventory.
- Tie content access to authorization and logging. Reduce the number of administrator accounts, log every access, and turn content review into a defined process that requires concrete suspicion and an approval step. That satisfies both the graduated approach and the proportionality principle.
- Standardize your offboarding. Put account deactivation, forwarding duration, archive retention and data deletion into a defined checklist. Mailboxes left open indefinitely are a source of both data breaches and non-compliance.
We can review your mail infrastructure, logging and backup policy together to see whether they line up with this decision. For an assessment on site at your office anywhere on Istanbul's Anatolian side, or remotely, reach us through our contact page.
Source: Personal Data Protection Authority (kvkk.gov.tr), Anadolu Agency, Official Gazette, 8 October 2026, issue 33394