Turkish Data Protection Board’s Principle Decision on Employee Monitoring

9 October 2026

The Personal Data Protection Board’s (“Board”) Principle Decision dated 16 September 2026 and numbered 2026/2035 on the procedures and principles for personal data processing carried out by employers through monitoring of business communication channels, particularly corporate e-mail accounts assigned to employees, was published in the Official Gazette dated 8 October 2026 and numbered 33394. 

The Board emphasizes that monitoring corporate e-mail accounts and other workplace communication channels constitutes personal data processing even where only traffic/log data is processed without accessing communication content, requiring employers to comply with the general principles and processing conditions under Law No. 6698, inform employees in advance, and ensure monitoring is carried out for a legitimate purpose in line with necessity and proportionality. 

 

You may access the Decision in the Official Gazette from here.