Principle Decision On The Monitoring Of Corporate Email Accounts And Work-Related Communication Channels Published

On 8 October 2026, the Personal Data Protection Board (the “Board”) published the “Principle Decision on the Procedures and Principles to Be Followed in Personal Data Processing Activities Carried Out Through the Monitoring of Communication Channels Used for Work-Related Purposes, Primarily Corporate E-mail Accounts Assigned to Employees by Employers” (the “Principle Decision”).

The Principle Decision sets out the limits of employers’ authority to monitor corporate e-mail accounts assigned to employees and other communication channels used for work-related purposes, as well as the principles to be followed in personal data processing activities carried out within this scope.

The key points highlighted in the Principle Decision are summarised below:

• The fact that corporate e-mail accounts and other communication tools belong to the employer does not grant the employer an unlimited right to monitor them. Even the examination of traffic data or log records without accessing e-mail content constitutes personal data processing and is subject to the obligations under the Personal Data Protection Law No. 6698 (the “Law”).

• Monitoring activities must take into account the distinction between work-related and private communications. Where such a distinction can be made, monitoring must be limited to work-related communications; where it cannot, the employer’s monitoring rights must be interpreted more restrictively. Employees must be informed in advance of any prohibitions or restrictions on personal use.
• General information is insufficient, and information that complies with Article 10 of the Law and contains the necessary details must be provided before monitoring begins. Under the Principle Decision, the legal basis, purpose, scope (traffic/log records or communication content) and method of monitoring, the conditions for accessing content, data retention periods and data subject rights under Article 11 of the Law must be clearly specified in the privacy notices provided for monitoring.

• Given the imbalance of power inherent in employment relationships, explicit consent should not, as a rule, be relied upon as the primary legal basis for e-mail monitoring. Monitoring activities must be based on an appropriate legal ground under the second paragraph of Article 5 of the Law, depending on the circumstances of the specific case.

• Monitoring activities must pursue a legitimate purpose and be conducted in accordance with the principle of graduated monitoring. Access to content must be limited to necessary and exceptional circumstances where traffic data is insufficient, and based on concrete suspicion and limited to the relevant allegation. Content reviews of undefined scope or continuous nature must be avoided; where misuse can be prevented through technical measures such as filtering or blocking, it must be taken into account that the employer does not have a general right to monitor.

• When monitoring communication content, the possibility of processing special categories of personal data must be taken into account, as well as the potential impact that accessing third parties’ personal data may have on those individuals.

• Access to data obtained through monitoring must be restricted to authorised individuals, access logs must be maintained, and necessary technical and organisational data security measures must be implemented.

• Following the termination of employment, the legal basis for processing personal data through corporate e-mail accounts must be assessed separately. As a rule, active use of the account must be discontinued, incoming communications must be protected from access by unrelated persons, and data for which there is no longer a valid legal basis must be disposed of. Limited-duration and controlled forwarding, automatic reply, archiving or retention arrangements may be considered on a case-by-case basis for business continuity, the right to defence or legal obligations.

In light of the Principle Decision, we recommend that employers consider the following steps as part of their compliance processes:

• Reviewing and updating the privacy information to be provided to employees to ensure that it clearly includes the legal basis, purpose, scope and method of monitoring, and data retention periods or preparing a separate privacy notice for the monitoring procedures.

• Reviewing internal policies and procedures governing the use of corporate e-mail accounts and other communication tools to clearly define the rules on personal use, the conditions for monitoring and the exceptional circumstances in which communication content may be accessed.

• Assessing existing monitoring practices against the principle of proportionality, prioritising less intrusive methods and limiting content monitoring to necessary and justified circumstances.

• Identifying the individuals authorised to access data obtained through monitoring and defining their access permissions, maintaining access logs, and implementing necessary technical and organisational security measures.

• Reviewing the procedures for closing former employees’ corporate e-mail accounts, managing incoming communications, forwarding, retention and disposal to ensure compliance with the law.

The Principle Decision states that, in the event of non-compliance with the matters specified, administrative action will be taken against the relevant data controllers pursuant to Article 18 of the Law, taking into account the circumstances of the specific case.