Turkey: Privacy

Under the Personal Data Protection Law No. 6698 (“Law”), what is decisive is not so much the nature of the data but whether it can be linked to a specific or identifiable natural person.

The Personal Data Protection Board (“Board”), through its Principle Decision dated 16 September 2026 and numbered 2026/2035, published in the Official Gazette dated 8 October 2026 and numbered 33394 (“Principle Decision”), established the procedures and principles governing employers’ monitoring of corporate email accounts allocated to employees and other communication channels used for business purposes.

As is known, pursuant to Article 18 of the Personal Data Protection Law No. 6698 dated 24 March 2016 (“Law”), titled “Misdemeanours”, the Personal Data Protection Board (“Board”) may impose administrative fines on data controllers and data processors in cases where the obligation to inform is not fulfilled, the obligations regarding data security are not complied with, the decisions rendered pursuant to Article 15 of the Law are not implemented, the obligation to register with and notify the Data Controllers Registry is violated, and the standard contracts—which must be among the appropriate safeguards required for the transfer of personal data abroad in certain circumstances—are not notified in accordance with the conditions set forth in the Law.