Can Employers Monitor Employees’ Emails? Türkiye’s Data Protection Board Issues a New Principle Decision
Selin Çetin Kumkumoğlu
Of Counsel
Yaren Alparslan
Associate
Buse Sığın
Trainee
The Principle Decision No. 2026/2035 (“Principle Decision”) of the Personal Data Protection Board (“Board”), published in the Official Gazette dated 8 October 2026, sets out the procedures and principles to be followed under the Personal Data Protection Law No. 6698 (“DPL”) when employers monitor corporate email accounts and other communication channels assigned to employees for work-related purposes.
The Board’s investigations revealed that employees’ corporate email accounts and other communication channels were being monitored, email content was being accessed, and traffic and log records were being examined. The Board also found that data obtained through filtering and routine monitoring practices were used in disciplinary proceedings or in connection with the termination of employment contracts, while employees had not been adequately, clearly and specifically informed about these processing activities.
Key Aspects of the Principle Decision
The Principle Decision emphasizes that the processing of personal data through the monitoring of corporate email accounts and other work communication channels must comply with the DPL. The fact that communication tools are owned by the employer or used at the workplace does not confer unlimited monitoring authority on the employer. In accordance with Articles 20 and 22 of the Constitution, the right to respect for private life and freedom of communication must be safeguarded. As reflected in the case law of the Constitutional Court of Türkiye and the European Court of Human Rights, monitoring must serve a legitimate purpose, employees must be informed clearly and in advance, and the monitoring must be relevant to that purpose, limited in scope and proportionate.
In this regard, it is important to distinguish between work-related use and personal use of communication tools. If the employer prohibits or restricts personal use, this must be clearly communicated to employees in a manner that is accessible and foreseeable. Where personal use is permitted, the scope of monitoring must be limited accordingly.
Key Stricter Proportionality Requirements for Content Monitoring
As a rule, content monitoring should be carried out only where there is a legitimate purpose linked to a concrete suspicion or a specific incident, and should be limited to that purpose. General, indiscriminate and continuous reviews with an unclear scope should be avoided. Any special categories of personal data or personal data relating to third parties that may be contained in messages or attachments must also be taken into account. Employees must be informed clearly and specifically, in advance, about the scope and method of monitoring.
This approach is consistent with the principles established by the Constitutional Court in E.Ü. (Application No. 2016/13010, 17 September 2020) and Celal Oraj Altunörgü (Application No. 2018/31036, 12 January 2021). These decisions distinguish between monitoring communication traffic and examining communication content, emphasize the need for stronger grounds for content monitoring, and require the scope and proportionality of the interference to be assessed.
Legal Grounds for Processing Personal Data under the DPL
Given the dependency and power imbalance inherent in the employment relationship, an employer’s reliance on an employee’s explicit consent should not, in itself, be regarded as a sufficient legal basis for processing personal data. Where explicit consent is relied upon, it must also be assessed whether such consent has been given freely. Depending on the circumstances of the case, the applicability of other legal grounds for processing under Article 5(2) of the DPL must also be considered.
Monitoring must be conducted in accordance with the general principles set out in the DPL, including the requirements that personal data processing be linked to a specific, clear and legitimate purpose, limited to what is necessary and proportionate. The data obtained must be retained only for as long as necessary.
Corporate Email Accounts Following Termination of Employment
Following termination of employment, the legal basis for processing personal data relating to the employee’s corporate email account must be reassessed. As a rule, the account should be deactivated, and data should be retained only to the extent necessary for specific and legitimate purposes.
Implications for Companies
In light of the Principle Decision, companies should review their existing monitoring practices concerning corporate email accounts and other work communication channels, as well as their employee privacy notices and internal policies and procedures. A general notification stating only that corporate email accounts may be monitored is insufficient. Employees must be informed clearly and specifically of the purpose and scope of monitoring, whether traffic and log records or email content will be examined, the circumstances in which access to content may occur, and the applicable data retention period.
Companies should also ensure that monitoring is necessary and proportionate, use less intrusive methods wherever possible, restrict access rights and maintain the confidentiality of the data accessed. In the event of non-compliance with these requirements, administrative action may be taken against the relevant data controllers pursuant to Article 18 of the DPL.
