The Principle Decision of the Personal Data Protection Board (“Board”) dated 16 September 2026 and numbered 2026/2035 (“Principle Decision”), published in the Official Gazette dated 8 October 2026 and numbered 33394, sets out procedures and principles regarding personal data processing activities carried out through the monitoring of communication channels used for the purposes of conducting business, particularly corporate email accounts allocated to employees by employers.
The key takeaway for employers is that monitoring must be based on a valid data processing condition under Law No. 6698 on the Protection of Personal Data (“LPPD”), employees must be informed in advance, and monitoring must be conducted in a purpose-limited and proportionate manner.
The principles set out in the Principle Decision are summarised below:
- Monitoring corporate email accounts and other business communication channels constitutes a personal data processing activity, even where only traffic/log records are reviewed, and does not grant the employer unlimited monitoring authority.
- The distinction between business and personal use should be taken into account in monitoring; the rules governing personal use should be clearly communicated to the employee, and monitoring should be limited in accordance with the principle of proportionality. This limitation applies even where personal use is prohibited; where business and personal use cannot be clearly distinguished, the scope of monitoring must be more narrowly defined.
- The employer’s technical ability to access a device, network or corporate system does not mean that it may freely access private correspondence in the employee’s personal email, messaging or social media accounts.
- The employee must be clearly informed in advance, in accordance with LPPD, regarding the purpose, scope and method of the monitoring. The privacy notice must also explain the identity of the data controller, the purposes of processing and transfer, the parties to whom the data may be transferred, the method of collection and its legal basis, the circumstances in which content may be accessed, the retention period, and the rights set out under Article 11 of the LPPD. A general notice regarding monitoring does not, in itself, satisfy the obligation to inform data subjects.
- A lawful basis for monitoring must be identified in accordance with Article 5 of the LPPD. Due to the imbalance of power between the employer and the employee, explicit consent cannot be regarded as the primary legal basis in every case. Where explicit consent is relied upon, whether it was given freely must be assessed in the circumstances of the specific case. Neither valid explicit consent nor any other lawful basis for data processing confers an unrestricted right to monitor.
- Monitoring should be carried out gradually and proportionately in compliance with the general principles set forth under Article 4 of the LPPD; where the purpose can be achieved through less intrusive means, content monitoring should not be conducted. Data must be processed only for specified and legitimate purposes, to the extent that it is relevant and necessary for those purposes, and must not be retained for longer than necessary.
- Content monitoring constitutes a more intrusive form of interference and should, as a rule, be carried out only where there is a legitimate purpose linked to a specific suspicion or incident, and only to the extent necessary to achieve that purpose. Broad, indiscriminate and continuous content reviews with no clearly defined scope should be avoided.
- Employers should take into account that content and attachments may contain special categories of personal data. The conditions set out in Article 6 of the LPPD and the adequate safeguards determined by the Board must be observed when processing such data. The impact of monitoring on the personal data of third parties contained in correspondence should also be assessed.
- Access to the data obtained must be restricted to a limited number of personnel authorised in accordance with their duties. Access logs must be maintained, and the confidentiality obligations of those accessing the data must be ensured.
- Upon termination of the employment relationship, the legal basis for processing the corporate email account and the data contained therein must be assessed separately. The termination of employment does not justify keeping the account and its data accessible or processing them indefinitely. Data for which the conditions for processing no longer exist must be deleted, destroyed or anonymised in accordance with the LPPD.
If non-compliance with the procedures and principles set out in the Principle Decision is identified, the Board will conduct an examination and assessment taking into account the circumstances of the specific case, and action will be taken against the relevant data controllers pursuant to Article 18 of the LPPD.
In this regard, we recommend that employers review their policies on the use and monitoring of corporate communication tools, employee privacy notices and offboarding procedures, and ensure that the grounds, scope and access authorisations for content reviews are determined in advance and documented.
You can access the full text of the Principle Decision here.
