Principle Decision No. 2026/2035 of the Personal Data Protection Board (KVKK) in Türkiye was published in the Official Gazette on 8 October. The decision limits the monitoring of employees' corporate email and other business communication channels: the fact that the tools belong to the company does not by itself grant unlimited monitoring rights; employees must be informed in advance, and monitoring must be limited to its purpose and proportionate.
Legal interpretation is a job for lawyers. What we see is that the decision also has concrete consequences on the IT side:
- Who can access what? The access rights of admin and IT accounts to employees' mailboxes should be reviewed; an "everyone can see everything" setup is risky.
- Access should be logged: Who accessed a mailbox and when should be visible in the logs. Microsoft 365 and Google Workspace can keep these audit logs.
- Retention and backup periods should be written down: How long are emails kept, and how long do they stay in backups?
- Accounts of departing employees: The steps for closing the account, forwarding and archiving should be defined in advance.
- The policy and the privacy notice should match the settings actually applied in the system.
At SMB Teknoloji we set up corporate email, access management, logging and backup infrastructure in line with KVKK.