Turkey's data regulator limits how employers read staff work email

Turkey's data regulator limits how employers read staff work email

8 October 2026: Turkey's Personal Data Protection Board (KVKK) has issued a principle decision setting out how employers may monitor corporate email accounts and other channels they give staff for work. The decision, numbered 2026/2035 and dated 16 September, was published on 8 October. It says owning the account or the device does not give an employer "unlimited" oversight, and that a breach can lead to action under Article 18 of Law 6698, the article that sets the authority's administrative fines.

Why the Board stepped in

The Board says it acted after a series of complaints and tip-offs. In the cases it examined, employers had monitored staff mailboxes, read message content, examined traffic and log records, and run filtering or routine checks, then used what they found in disciplinary cases or to end employment, without telling staff clearly and concretely that this would happen. The decision frames mailbox checks as a balance between the employer's management rights and the employee's constitutional rights to privacy, data protection and freedom of communication.

The rules employers now have to meet

The decision lists the conditions point by point. In our reading of the Turkish text, the main ones are:

• A notice telling staff only that the corporate account "may be checked" is not enough; the notice under Article 10 must state the legal basis, purpose, scope and method, when message content may be accessed, how long data is kept, and employees' rights.
• Explicit consent is a weak basis: because of the dependency in the employment relationship, explicit consent cannot as a rule be treated as the primary legal ground for email monitoring, and where it is used its freedom must be judged case by case.
• Checks are graduated: where a less intrusive method can achieve the purpose, a heavier one may not be used.
• Reading message content should be limited to a specific suspicion or incident and to what that purpose needs, and general, open-ended or continuous content reviews should be avoided.
• Technical access is not legal access. Being able to reach a device, session or network does not entitle the employer to read an employee's personal email, messaging or social media accounts on it.

The decision also asks employers to separate business from private use when setting the scope of checks, to remember that messages may hold special-category data and other people's data, to limit access to a small number of authorised staff with access logs and confidentiality duties, and to treat a leaver's mailbox as needing its own legal basis rather than remaining available indefinitely.

What changes in practice

For HR and IT teams in Turkey, the decision turns a common policy line, a clause in the employee handbook reserving the right to inspect company email, into something the Board has said does not by itself meet the law. Employers that rely on that clause, or on a consent form signed at hiring, will need a specific privacy notice for monitoring and a written procedure that starts with the least intrusive check.

Monitoring and archiving tools that keep full message content, or that give broad search rights to administrators, are where the access-control and logging points bite. The Board's separate notice of 1 October on how replies to data subject requests must be delivered sits alongside this one for employers handling staff requests to see what was collected about them.

Related on TrustList:

• Austria lets single-permit holders change employer after 45 days
• Fifteen employment rule changes in nine countries this autumn
• House bill would lift H-1B penalties to $250,000 and a 10-year ban

Sources

• KVKK (Personal Data Protection Authority of Türkiye): Principle Decision of the Board dated 16/09/2026 and numbered 2026/2035 (in Turkish), 8 October 2026