What is principle decision 2026/2035?
With principle decision 2026/2035 of 16 September 2026 (Official Gazette 8 October 2026, no. 33394), the Personal Data Protection Board set out the procedures and principles employers must follow when auditing the corporate e-mail accounts assigned to employees and the other communication channels used to carry out work. Internal messaging applications and file areas are also within scope, depending on the facts of the case. Every scan of employees’ e-mail, files and chats is an audit activity within the meaning of this decision.
The full text is on the Authority’s website: Principle decision 2026/2035 (kvkk.gov.tr, in Turkish).
This page is not legal advice. Assess with your own legal adviser how the decision applies to your organisation; Compliance Agent does not replace that assessment, it helps you verify adherence to your organisation’s policies.
What are the principles of the decision?
The decision rests on six main ideas; each is described briefly below, followed by how Compliance Agent supports it:
- Employees are informed in advance and in concrete terms.
- Business and private use are kept apart.
- Auditing is gradual; content is the last resort.
- Access is limited and recorded.
- There is no hidden review.
- When the employment relationship ends, the account is closed and data is kept limited.
1. Notice: what must the employee be told in advance?
What the decision says. Employees must be informed before any audit, clearly, understandably and concretely: the legal ground and purpose of the audit, its scope (traffic data or content), the cases in which content will be accessed, the method, the retention period, the consequences, who will see the data and the data subject’s rights. A general statement or a general undertaking signed by the employee is not enough. The decision also states that, because of the imbalance of power between employer and employee, the employee’s explicit consent should as a rule not be the primary legal ground for such audits.
How Compliance Agent supports it. No scan can run without the employee’s permission. Each employee gives permission through a personal link your organisation sends; who has given permission and who is still pending is visible in the product. This permission does not replace the notice and is not a legal ground: you prepare your notice and your permission mechanism for your own organisation, and you decide with your legal adviser which legal ground you rely on.
2. How are business and private use kept apart?
What the decision says. Whether corporate communication tools may be used for private purposes, and on what conditions, must be decided in advance, transparently, and announced to employees. The audit is limited to business communication; where business and private communication cannot be told apart, the audit is interpreted more narrowly.
How Compliance Agent supports it. You set the scope: user group selection, date range and rule selection. The product cannot separate business from private correspondence inside a mailbox; you make that distinction through your policy and your choice of scope. Where it cannot be made, keep the scope narrower.
3. Gradual: why is content the last resort?
What the decision says. Auditing is gradual by principle. Access to content arises only in exceptional cases where a review of traffic data is not enough; it is done where there is concrete suspicion and limited to the allegation. Content review that is indeterminate in scope, general or ongoing is to be avoided. Where preventive technical measures (filtering, blocking) are possible, they come first.
How Compliance Agent supports it. The product’s rules work by reading content; whether a content scan is necessary and proportionate is therefore your organisation’s assessment. The product offers the tools that narrow the scope: Safe Scan, which touches nothing; trying a rule on sample text before scanning (Test rules); user group and date range selection; and Reveal, which asks for a duration, a reason and a request number before full content is shown. A scan is never hidden or unannounced, never runs without pause and never processes each message as it arrives. Preventive technical measures come first; Compliance Agent does not replace them.
4. Who can see the results, and how is access recorded?
What the decision says. Access to the data must be limited to a small number of authorised staff, tied to their job description; access records must be kept; those staff must be bound by confidentiality; and the data obtained must be kept only as long as the purpose requires.
How Compliance Agent supports it. Three roles: Admin, Security Manager and Reporter; the roles are Microsoft Entra application roles, and we recommend limiting access to the results to the fewest people necessary. The results show the rule that matched; to see the full content, Reveal asks for a duration, a reason and a request number, and every view is written to the audit log. Every administrative step is recorded; Verify integrity checks that no entry has been changed or is missing. Results, logs, the audit log and the OneDrive copies taken before an action stay in your own Azure storage; you manage the retention period according to your organisation’s policy.
5. Why is hidden review unlawful?
What the decision says. Hidden review, and tools that record every operation indiscriminately, are unlawful.
How Compliance Agent supports it. It does not scan without the employee’s permission; the permission is given through a personal link, can be withdrawn by the employee, and its withdrawal is recorded in the audit log too. Scans are runs you start, in the periods stated in your notice to employees and announced in advance. The product is not designed to look into a particular employee.
6. What happens when the employment relationship ends?
What the decision says. When the employment relationship ends the account is closed; forwarding and archiving are kept limited and justified; data that must be retained is kept closed to access.
How Compliance Agent supports it. Whatever action your organisation takes on a leaver’s data under its own policy is the organisation’s decision; the product does not take that decision automatically and records every step.
Third parties and sensitive data
E-mail and chats also contain personal data of the other party to the correspondence, for example senders outside the organisation; the employee’s permission does not cover those people. Attachments and message bodies may contain sensitive personal data. The decision expects data whose review is not necessary to be left out of scope; narrow the scope with user group, date range and rule selection, and address this risk in your notice.
FAQ: is Compliance Agent enough to apply the decision?
No. How the decision applies to your organisation, which legal ground you rely on and your notice to employees are matters for your organisation and your legal adviser. Compliance Agent helps you verify adherence to your organisation’s policies with tools that narrow the scope, limit access and record every step. The organisation makes the decisions.
Book a demo · KVKK page · How it works · Security and data · FAQ