KVKK principle decision: How far can employers monitor work email?

Decision No. 2026/2035 of Turkey's Personal Data Protection Board (KVKK), dated 16 September 2026, was published in the Official Gazette (Resmî Gazete) No. 33394 on 8 October 2026. The principle decision sets out when an employer may monitor the corporate email accounts it gives to staff and the other channels used for work. This article summarizes the main principles and adds a practical checklist for employers. Source: Resmî Gazete, 8 October 2026, No. 33394 (in Turkish).

What does the decision cover?

Email is only part of it. The Board also names internal messaging apps, corporate instant messaging accounts, customer relationship (CRM) and ticketing systems, and the chat and recording areas of meeting platforms as channels that may be subject to monitoring, depending on the facts of each case.

In the Board's view, a corporate mailbox is more than a communication tool. It holds the employee's professional (and sometimes personal) network, work patterns and correspondence. Monitoring it is therefore a processing activity that must balance the employer's right to manage against the employee's right to data protection and freedom of communication.

The main principles

A company device does not mean unlimited monitoring

The fact that the tools belong to the employer, or are used at the workplace, does not on its own give the employer unlimited and absolute monitoring powers. Technical access and legal authority are different things: having technical control over a device, network or system does not mean the employer may freely read an employee's personal email account, personal messaging app or social media inbox.

Logs are personal data too

Processing only traffic/log records, without ever opening the content, is still a processing activity in its own right. Log reviews are therefore subject to the general principles (Art. 4), processing conditions (Arts. 5 and 6), the duty to inform (Art. 10) and the data security obligations (Art. 12) of Law No. 6698.

Business use versus private use

An employer may set rules on private use of work tools, but the rules must be clear, understandable and knowable by the employee, and must be clearly communicated. Even where private use is banned, monitoring is limited by proportionality. Where private use is allowed and business messages can be separated from private ones, monitoring should cover business messages only, and private correspondence should stay out of scope. Where the two cannot be separated, the employer's powers should be read more narrowly. If a breach of a private-use ban can be seen from non-content data, opening the content as well is not considered necessary or proportionate.

Specific notice in advance

Telling employees beforehand is one of the decisive factors for lawfulness. A generic line such as "corporate email may be monitored by the employer" satisfies neither the notice requirement nor the duty to inform. According to the Board, the privacy notice must go beyond abstract wording and state clearly and concretely:

• the legal basis and purpose of the processing,
• the scope of monitoring,
• whether monitoring will rely on traffic/log records or on content review,
• in which cases content may be accessed,
• how long the data will be kept,
• the employee's rights under Article 11 of Law No. 6698.

An employee who has not been informed in advance and in the proper way can reasonably expect that their personal data and communications will not be interfered with.

Explicit consent is not the main basis

Because of the dependency and power imbalance in employment, explicit consent should not, as a rule, be the primary legal basis for email monitoring. Where consent is relied on, whether it was freely given must be assessed separately. Depending on the case, the Board points to these conditions instead: compliance with a legal obligation (Art. 5(2)(ç)), the establishment, exercise or protection of a right (Art. 5(2)(e)) and the controller's legitimate interest (Art. 5(2)(f)). Even when one of these applies, it does not grant unlimited monitoring powers.

Stepwise and proportionate

Monitoring must be stepwise. If the legitimate aim can be reached by a less intrusive method, a more intrusive one may not be used. Content may be accessed only in exceptional cases, where reviewing traffic data is not enough and access to content is essential. Content review requires a concrete suspicion and must be limited to that allegation; open-ended, general and continuous content reviews must be avoided. Where misuse can be prevented technically, for example by filtering or blocking, no general right to monitor arises.

When content is reviewed, keep in mind that the body or attachments may contain special categories of personal data, and that messages usually contain the personal data of the other parties as well.

No secret or continuous blanket monitoring

Monitoring through secret methods the employee was not told about, or through tools that record all of the employee's actions indiscriminately, is considered unlawful. Constant, uninterrupted surveillance is not considered proportionate either. Monitoring must happen with the employee's knowledge and within a foreseeable framework, and the data obtained may be kept only as long as the purpose requires.

Restricted, logged access

Access to data obtained through monitoring must be limited to a small number of staff authorized for that task. Permissions should follow job descriptions, access must be logged, and those with access must be bound by confidentiality.

Mailboxes of leavers

When employment ends, the legal basis for processing the mailbox must be assessed again. As a rule, the account should be closed to the employee and to new access, incoming messages should not be visible to unrelated people, and personal data with no remaining legal basis should be destroyed. For business continuity, uninterrupted corporate communication, the right of defence in legal disputes or statutory obligations, limited, time-bound, access-controlled and logged forwarding, auto-reply, archiving or retention may be considered case by case.

What if employers do not comply?

The Board states that where it finds these obligations have not been met, it will examine the case on its facts and take administrative action against the controllers concerned under Article 18 of Law No. 6698.

Checklist for employers

1. Acceptable use policy: State in writing whether private use of email, messaging, CRM, ticketing and meeting tools is allowed, and if so, within which limits. Communicate the policy to staff.
2. A monitoring-specific privacy notice: Replace a generic "may be monitored" line with a notice that states the legal basis, purpose, scope, logs or content, when content may be opened, retention and Article 11 rights. Deliver it before any monitoring and keep proof.
3. A stepwise review procedure: Technical controls first (filtering, blocking), then log review; content review only on concrete suspicion and limited to the allegation. Record who approved a review and why.
4. Role-based access: Limit who can read mailbox content and use search/eDiscovery tools, based on job descriptions. Review broad admin rights and standing Full Access permissions. Bind those with access to confidentiality.
5. Access logs: Keep mailbox auditing and the Microsoft Purview audit log enabled in Microsoft 365, and the audit and investigation logs in the Google Workspace Admin console. Check regularly who accessed which mailbox.
6. Retention: Set retention periods for logs, review outputs and archives that match the purpose. Configure retention policies in your tools accordingly and delete data when the period ends.
7. Offboarding procedure: Document account closure, who receives forwarded mail and for how long, auto-replies, archiving and deletion. Keep forwarding and archive access time-bound and logged.
8. Review monitoring tools: Inventory any software that records all user activity indiscriminately. Remove monitoring that runs without employees' knowledge or continuously.

The ISO 27001 link

The decision's expectations map naturally to several ISO/IEC 27001:2022 Annex A controls:

• 5.10 Acceptable use of information and other associated assets: rules on private use of work tools and the acceptable use policy.
• 5.15 Access control and 5.18 Access rights: role-based access to content and log data, tied to job descriptions, with regular reviews.
• 5.34 Privacy and protection of PII: identifying and meeting KVKK requirements such as notice, legal basis and retention.
• 6.5 Responsibilities after termination or change of employment: the offboarding procedure and account closure.
• 8.15 Logging: records of mailbox access and admin actions.

Certificates are issued by an accredited certification body. Doğa Network provides consulting and does not certify.

This article is general information and is not legal advice.

How can Doğa Network help?

Our team can help you review mailbox permissions in Microsoft 365 and Google Workspace, enable audit logs, set retention policies, build an offboarding procedure and work towards ISO 27001. For the legal content of your privacy notice, we recommend working with your legal adviser. Call us on +90 850 888 3642 or email hi@doga.network.

Source

• Resmî Gazete, 8 October 2026, No. 33394 – KVKK Board Decision 2026/2035 (in Turkish)