Corporate email monitoring has long been seen through one lens: "the server is ours, the mailbox is ours, we can read what we want." Türkiye's Personal Data Protection Board has officially put an end to that view. The Board's Principle Decision No. 2026/2035, dated September 16, 2026, was published in the Official Gazette No. 33394 on October 8, 2026. It covers email, internal messaging, conversations in ticketing and CRM systems, and the chat and recording areas of meeting platforms.
We care about this decision most as the people who build and run mail servers, because most of the settings it targets can be switched on with a few clicks in an admin panel. In this article we explain it not from a lawyer's point of view, but from the point of view of the person who sets up and runs the system.
The core idea: technical access is not permission to read
The key point of the decision is this: having technical authority over a device, session, network or system does not mean the employer may freely access the content of messages. Technical access and legal authority to access must be kept apart.
Any system administrator knows the reality. Whoever administers a mail server can open any mailbox, write a forwarding rule or export an entire account. The decision says that this ability is not a right. Owning the communication tools, or having them used at the workplace, does not by itself grant unlimited monitoring authority.
Logs are data too; content is far heavier
The decision defines two levels:
| Level | What is processed | What the decision says |
|---|---|---|
| Traffic/log monitoring | Sender, recipient, time, size, IP, filter result | Processing personal data even without looking at content; notice and data security obligations apply |
| Content monitoring | Message body and attachments | The most intrusive step; allowed only with a concrete suspicion, limited to that allegation, as an exception |
Monitoring must be gradual: if the goal can be reached in a less intrusive way, a heavier method may not be used. One sentence matters a lot to us: if misuse can be prevented by technical means such as filtering or blocking, no general right to monitor arises. A spam filter, a malicious attachment block or a rule that stops sensitive files from leaving the company always comes before reading content.
Common settings that are now risky
Some settings we often see on mail systems should be reconsidered after this decision:
- Hidden copies of all mailboxes: Automatically copying every incoming and outgoing message to a "monitoring" address. The decision says continuous, uninterrupted surveillance cannot be considered proportionate, and that tools recording all of an employee's activity indiscriminately are unlawful.
- Forwarding rules set up without telling anyone: Covert monitoring without prior notice is explicitly unlawful under the decision.
- A shared admin account: Access must be limited to authorized staff, logged, and those people must be bound by confidentiality. You cannot keep that record with a single admin password everyone knows.
- Opening a departed employee's mailbox to a manager: As a rule the account should be closed and incoming mail kept from unrelated people. Forwarding, auto-reply or archiving are possible for business continuity, but only if limited, time-bound, with named authorized people and logged.
- Personal accounts left logged in on a company computer: Access to an employee's personal email, WhatsApp or social media messages is outside this authority, even if the session is open.
Most of these settings are switched on not out of bad intent but because "it might come in handy." We have also set up such copy arrangements in the past at customers' request. Once the decision was published, our first step was to inform those customers in writing and propose alternatives.
Notice: "your email may be monitored" is not enough
The decision states plainly that a general sentence added to the employment contract is not sufficient. Before monitoring starts, the employee must be told concretely:
- The legal basis and purpose of monitoring
- Whether monitoring runs on logs or on content
- In which cases content may be accessed
- How long the data is kept
- The employee's rights under Article 11 of KVKK (Türkiye's Personal Data Protection Law)
An employee who has not been informed is considered to have a reasonable expectation that their communications will not be interfered with. One more important detail: because of the power imbalance in employment, explicit consent should not, as a rule, be the legal basis. Depending on the case, the basis may be a legal obligation, the protection of a right or legitimate interest, and none of these grants unlimited authority either. We cover the difference between notice and consent in our explicit consent article.
The company's rule on personal use also matters. Monitoring is assessed differently depending on whether it has been clearly announced that work channels are for business only, or whether there is no rule at all. Even where personal use is banned, monitoring stays limited by proportionality, and an employee's private correspondence of a sensitive nature is left out.
A checklist for the system side
Applying the decision is largely technical work. We suggest checking these on your mail system:
- List every automatic copy (BCC), forwarding and delegation rule defined on the server. Write down the purpose and legal basis of each.
- If a blanket copy is needed, turn it into an archive with logged access instead of a readable mailbox. Open the archive only with a written request and approval, limited to a specific account and date range.
- Make admin accounts personal; retire shared passwords.
- Write mailbox access, exports and rule changes to a log that cannot be deleted.
- Put technical measures first, such as spam and malware filters and outbound sensitive data blocks; keep reading content as the last resort.
- Define a written process for departing employees: closing the account, time-bound auto-reply or forwarding, retention period and deletion.
- Set retention periods for logs and archives, and delete them when the period ends.
Most of these steps are a natural part of a corporate email setup and of KVKK compliance work. For a practical setup of shared mailboxes and departed employees' accounts, see our shared mailboxes guide.
The company hosting the mail system is not the data controller for its customer's employees. Publishing the notice and deciding on monitoring is the employer's job, as the data controller.
What happens in case of non-compliance?
The decision states that where non-compliance is found, the case will be examined and administrative action will be taken under Article 18 of KVKK. Administrative fine ranges are updated every year; we list the 2026 amounts with their source on our KVKK approach page. Unauthorized access to correspondence can also have criminal law consequences. That is why we recommend making the final decision together with your legal counsel.
Frequently asked questions
Can an employer not monitor corporate email at all?
It can, within limits. The employee must be informed concretely in advance, monitoring must have a legitimate purpose, and logs and technical measures must come first. Content may only be reviewed when there is a concrete suspicion, and only within the scope of that allegation.
We have signed consent from employees. Is that enough?
As a rule, no. Because of the power imbalance in employment, the decision asks that explicit consent not be used as the primary basis for email monitoring. A signed form is useful only to document that the employee was informed.
We want all mail copied to a single address. Is that possible?
A continuous copy to a readable mailbox carries serious risk under the decision. If the need is business continuity or possible disputes, an archive whose access requires approval and is logged is a much safer solution.
Does the decision cover only email?
No. Internal messaging apps, corporate instant messaging accounts, CRM and ticketing systems, and the chat and recording areas of meeting platforms are also covered.
Can you check our current mail system?
Yes. We extract the copy, forwarding and access settings on your server and prepare a plain-language report. Reach us through our contact page or at +90 850 432 55 13.
Source: Personal Data Protection Board, Principle Decision No. 2026/2035 dated 16.09.2026, Official Gazette 08.10.2026, Issue 33394.
The Globya assistant is online 24/7; it answers right away and passes your question to the team if needed.