Turkey's Personal Data Protection Board published a principle decision on monitoring corporate e-mail in the Official Gazette on 8 October 2026. It sets out advance notice, graduated access and proportionality requirements in 16 articles.
Turkey's Personal Data Protection Board (KVKK) has set firm limits on a practice most companies assumed was theirs alone to decide: monitoring employees' corporate e-mail. The board's principle decision was published in the Official Gazette on 8 October 2026 and took effect immediately. Its central message is that owning the communication tools does not, by itself, create an unlimited right to inspect them.
The decision states that reaching a device, session or network technically does not grant the legal authority to read its contents. Equally important for IT teams: keeping traffic and log records alone already counts as processing personal data. Even where no message is opened, those records fall under the law's general principles, lawful processing conditions, notice duty and security obligations.
The limits the decision sets
- Specific advance notice. A single line saying the account "may be audited" is not enough. The notice must separately set out the legal basis, purpose and scope, whether monitoring covers logs or message content, the circumstances under which content may be accessed, retention periods, and the employee's rights.
- A graduated approach. The least intrusive method comes first. Access to content is permitted only in exceptional cases, where reviewing traffic data is insufficient and access is genuinely necessary.
- Concrete suspicion and proportionality. Vague, general or continuous content review is not accepted. Continuous surveillance is not considered proportionate even where personal use has been banned outright.
- No covert monitoring. Monitoring carried out without prior notice, and tools that record every employee action indiscriminately, are treated as unlawful.
- Consent is not the answer. Because of the power imbalance in an employment relationship, explicit consent should as a rule not be the primary legal basis relied upon.
What this changes for SMEs
The board set out the procedures and principles in 16 articles (Source: Memurlar.net, decision no. 2026/2035 dated 16 September 2026). Where these obligations are not met, the decision notes that administrative action may be taken against data controllers under Article 18 of Law No. 6698.
This is not a matter only for large legal departments. Any business running its own mail server, holding an administrator account on Microsoft 365 or Google Workspace, or forwarding and archiving mailboxes when staff leave is within scope. Three mistakes recur in practice: treating a one-line "monitoring" clause in a contract as a proper notice; opening a mailbox through an admin account with no access record; and forwarding a departed employee's account to a colleague indefinitely.
On that last point the decision is specific. A departing employee's account should as a rule be closed. Forwarding, auto-replies and archiving may be permissible case by case, but only where they are limited, time-bound, access-controlled and documented. What is technically easy is no longer legally free.
What we recommend at Kamer Bilişim
- Match your privacy notice to your technical reality. Start with an inventory: which logs your mail platform keeps, how long they are retained, and when content is opened. The notice should mirror that inventory exactly. If the document and the server configuration disagree, no defensible position is left.
- Make administrative access logged and two-stage. Restrict mailbox content access to a small number of named people, log every such access, and require a written justification approved by a second person before any content review. Confirm that audit logging is switched on in Microsoft 365 or Exchange.
- Put offboarding into a written procedure. Account closure, forwarding duration (30 days, for instance), archive retention and who signs off each step belong on one checklist. That gives you something to show in an audit and closes the account without losing institutional knowledge.
To review your mail infrastructure, logging policy and data protection documentation against this decision together, reach us through our contact page. We provide on-site support across the Anatolian side of Istanbul and remote support elsewhere.
Source: Anadolu Agency, Memurlar.net, Official Gazette of the Republic of Türkiye (8 October 2026, issue 33394)
Source: Anadolu Ajansı