Turkey's data authority sets limits on corporate email monitoring

Turkey's Personal Data Protection Board (KVKK) has published principle decision no. 2026/2035, dated 16 September 2026, in the Official Gazette on 8 October 2026. The decision sets out, in unprecedented detail, how far an employer may go in monitoring staff correspondence on corporate email and other workplace communication channels. Because it is a principle decision rather than a ruling on a single complaint, it applies to every data controller in the country.

What the decision says

The Board's starting point is that examining an employee's email traffic logs counts as personal data processing in its own right, even if no message content is ever opened. Owning the communication tools, or having them on company premises, therefore does not create an unlimited or absolute right to monitor. The main points:

• Specific notice must come first. Employees must be told the legal basis, purpose and scope of monitoring, whether it covers traffic data only or content as well, the circumstances in which content may be accessed, and how long the data is kept. Generic, abstract wording is not considered sufficient.
• Monitoring must be graduated and proportionate. Accessing message content is an exceptional measure. Less intrusive options, such as traffic logs or subject lines, must be considered first.
• Technical access is not legal authority. The fact that an IT team can reach a system, device or session does not give it the right to read correspondence.
• Covert or blanket monitoring is unlawful. Monitoring without prior notice, and tools that record all employee activity indiscriminately, fall outside what the Board accepts.
• Private correspondence stops the review. If personal messages are encountered, the examination must stop and that content must not be copied or stored.

Controllers that fail to comply may face administrative action under Article 18 of Law No. 6698.

What it means for smaller companies

Large organisations usually already have written IT policies, employee privacy notices and log management in place. In small and mid-sized companies, corporate email is typically run from a single administrator account. Opening a mailbox after someone leaves, searching backups when something looks suspicious, or switching on a security tool that records all traffic tends to be treated as routine IT work. Under this decision, each of those steps now requires a written policy, a documented legal basis and notice given in advance.

The exposure is greatest where correspondence is the business process itself: shipping agencies and maritime firms, construction offices, logistics companies and office-tower tenants run most of their daily work through email, and the same mailboxes hold customer, supplier and employee data side by side.

What we recommend at Kamer Bilişim

• Put your corporate email policy in writing and announce it. One document should cover the limits on personal use, what data is retained and for how long, and the circumstances in which content may be accessed. Your employee privacy notices should match that document exactly.
• Separate administrator privileges and log every access. Mailbox access should not rest on one person's discretion. Record who accessed which mailbox under whose approval, and define a retention period for those records.
• Review the monitoring and backup tools you already run. If your mail gateway, DLP, endpoint agent or backup system is set to "capture everything", narrow its scope to what the stated purpose actually requires and document the configuration.

If you would like your corporate email infrastructure, logging and backup policies reviewed against this decision, you can reach us through our contact page. We provide on-site support across the Anatolian side of Istanbul and remote support elsewhere.

Source: Alomaliye.com — Personal Data Protection Board principle decision no. 2026/2035 of 16/09/2026 (Official Gazette, 8 October 2026); corroborated by Ekonomim and Diken.