Corporate e-mail monitoring: what the 2026 KVKK decision changes

In most organizations, corporate e-mail is both the largest store of personal data and the least managed one. Board Principle Decision 2026/2035 of 16 September 2026, issued by Türkiye’s data protection authority, ties the employer’s access to that store to explicit principles and rejects the assumption that “it is our server, so it is our mail”. This article explains the decision’s key distinctions and their operational consequences for mail archives, access logs and retention periods.

This article is not legal advice; the application of the decision to your organization should be confirmed with your legal function.

What the decision covers

The decision sets out the procedures and principles to be followed when employers monitor corporate e-mail accounts assigned to employees and, more broadly, any communication channel assigned for carrying out work. The scope is therefore not limited to e-mail; other work channels fall under the same frame.

Its starting point is that monitoring is a data processing activity. That characterization matters. Monitoring is not treated as an information security measure or a management prerogative but as processing of personal data, which brings it under the Law’s processing conditions, principles and information duties. The decision states that this activity requires a “fair balance” between the employer’s management right and the employee’s private life and freedom of communication.

The Authority’s webinar of 13 October 2026, “Current Developments in Personal Data Protection: 2026 Principle Decisions and Public Announcements”, was announced as the event where this decision is discussed alongside the year’s other developments; readers who want the Authority’s own account of how the decision is to be read in practice should refer to it.

Technical access versus legal access

The decision’s most durable contribution is the distinction between “being technically able to access and being legally able to access”. The fact that a system administrator can open the mail server, the backups or a PST file does not mean the employer is legally entitled to read that content. Ownership of the tool does not confer unlimited monitoring authority.

The distinction calls three common practices into question. First, automatically handing a departed employee’s mailbox to their manager. Second, searching backups or archives for content “just in case”. Third, security teams continuously scanning all mail traffic with generic tools. All three are technically possible; for each, the decision expects a justification and prior information covering purpose, scope, method and retention period.

Rules must be clear, understandable and knowable. The decision does not consider a general notice sufficient; the purpose, scope, method and retention period of monitoring must be explained explicitly. A single clause in an employment contract stating that “corporate tools may be monitored” does not meet that standard. The decision also states that explicit consent cannot be the primary legal basis in every case within an employment relationship, because the employee’s position relative to the employer makes it doubtful whether consent is freely given.

Separating work use from private use

The decision asks employers to distinguish work use from private use. Whether corporate accounts may be used for private purposes, how such use is to be distinguished if allowed, and how private content is to be protected during monitoring are matters the organization must determine and communicate in advance.

For operations, the distinction is a reminder that the content of a mail archive is not uniform. The same PST file holds customer contracts, payroll attachments, medical report attachments, personal correspondence and bank notifications side by side. Calling an archive “secure” without classifying its content is not possible; classification shows which content is business data, which is personal data and which is special-category data, and makes a realistic narrowing of the monitoring scope possible.

Proportionality, the graduated approach and the limit on content review

The decision requires monitoring to follow the principles of proportionality and a graduated approach. A graduated approach means starting with the least intrusive method: first a review at the traffic or metadata level, and only where there is a concrete suspicion or incident a move to the content level. Content review must be limited to a concrete suspicion or incident, and content reviews that are “indeterminate in scope, general and continuous” must be avoided.

This raises a question for organizations that run personal data discovery: is continuous content scanning of live mail traffic the same thing as inventory-driven discovery of archive files? The two activities serve different purposes. The first watches an employee’s ongoing communication; the second brings the organization’s data at rest under its retention obligations into the inventory, enforces retention and narrows access. Even the second cannot be done arbitrarily: its purpose, scope and method must be defined, its results shared with a limited set of personnel, and every access logged. But its purpose is to meet the organization’s data obligations, not to watch employees. The legal assessment of that distinction for a specific organization belongs to its legal function.

The table below summarizes the difference that emerges when the decision’s principles are applied to the two activities.

Principle	Live mail content monitoring	Archive file (PST/OST/MSG) discovery
Purpose	Supervising employee behaviour	Personal data inventory, retention, access reduction
Scope	High risk of being continuous and general	Defined file sets, defined scan scope
Graduated approach	Content review without concrete suspicion is problematic	Reported at data-type and class level; masked samples
Access	Must be narrow and logged	Role-based; every view and action in the audit log
Retention	Limited period	Retention calendar; expired files enter the disposal workflow

Access logs, retention and the end of employment

The decision requires that access to data within the monitoring scope be limited to a restricted set of personnel, that access logs be kept, and that the retention period be limited. When the employment relationship ends, the data does not remain accessible indefinitely.

These three requirements map onto three gaps found in most organizations’ mail archives. First, the ACLs of the shares holding PST files have widened over the years; groups such as “Domain Users” or “Everyone” hold read access. Second, there is no record of who accessed those files and when; file system auditing is off or the logs roll over quickly. Third, there is no defined retention period for former employees’ archives; the files are kept indefinitely “in case they are needed”.

An example scenario: at a mid-sized services company, the mailboxes of departed employees are exported as PST files and placed in an “Archive” folder on a file server. The folder is open to the entire IT team and to a “Managers” group defined ten years ago; some of the group’s members have left the company and their SIDs can no longer be resolved. Against the decision’s principles, this folder is problematic on access restriction, access logging and retention all at once. Technically everyone can reach it; legally, nobody has defined who may.

Archive discovery versus live mail monitoring

Seratus’s e-mail scope today is archive files only: PST, OST and MSG. Seratus opens those files, extracts personal data from message bodies and attachments, and does not connect to a live mailbox. That design choice aligns with the decision’s principles of proportionality and a graduated approach: the goal is not to watch mail traffic but to inventory the mail data at rest in the organization’s possession, make its access visible and enforce its retention period.

The output of archive discovery is not a reading of an employee’s correspondence. It is a report, with masked samples, of which data types a file contains (national ID numbers, IBANs, health data, card numbers) and at what confidence level. Findings are opened to a restricted set of people through role-based access, and every view, assignment and action is written to the audit log. That is the product-level counterpart of the decision’s requirement that access be limited to designated personnel and logged.

How Seratus closes these gaps

Gap 1: Nobody knows where the mail archives are. Seratus’s agentless discovery scans SMB/NFS shares, local disks on Windows, Linux and macOS, Microsoft 365 libraries and S3-compatible object storage over a read-only connection, and opens PST, OST and MSG files where they sit. An interrupted scan resumes where it stopped.

Gap 2: Access to the archives is undefined. The ACLs, sharing links and group memberships of the folder holding the file are written into the access and exposure graph. Departed-user access, unresolved SIDs, circular group memberships and “everyone in the organization” sharing are brought to the front. Access reduction is assigned to an owner as a permission-removal action and carried out under a separate approval authority.

Gap 3: The archive content is unclassified. The Turkish-specific detection engine finds national ID numbers, IBANs, phone numbers, card numbers and health data in message bodies and attachments, in context; every finding is shown with a confidence percentage and a masked sample. The classification label sets the file’s confidentiality level and business category.

Gap 4: Retention is not enforced. Labels are bound to the retention calendar. When the period defined for former employees’ archives expires, the file lands on the “gaps” list and enters the disposal or quarantine workflow; the decision’s principle that data is not “accessible indefinitely” becomes an operational rule.

Gap 5: There is no access or action record. In Seratus every view, assignment, approval and action is written to the audit log with who, when and why. The audit report and source-level detail export to PDF, Excel or CSV, and findings can be forwarded to SIEM and ticketing systems.

Takeaway

Principle Decision 2026/2035 removes corporate e-mail from the category of spaces an employer may browse freely and ties every access to conditions of purpose, scope, method, duration and logging. The place where those conditions are hardest to meet is not live mail but the archives that have been waiting on file servers for years. A PST file whose location is unknown, which is open to everyone and which is kept indefinitely breaches every principle of the decision at once. Seratus finds those files, classifies their content, shows who can reach them, enforces retention and evidences every step, without connecting to a live mailbox.