# Turkey Personal Data Protection Authority activities

> Live situation record from CLSTR: https://clstr.news/situations/turkey-personal-data-protection-authority-activities
> Updated: 2026-10-10T07:19:00.000Z. Sources: 19. Developments: 3.

The Turkish Personal Data Protection Authority (KVKK) has reported significant activity regarding data privacy enforcement and regulation. Faruk Bilir, President of the KVKK, announced that the institution has processed approximately 69,000 applications concerning personal data protection since 2017, out of a total of 72,500 applications received. The authority conducts investigations into complaints to uphold constitutional rights to privacy, which can result in administrative fines.

Building on its regulatory role, the KVKK has issued new rules specifically addressing the monitoring of employee communications. Published in the Official Gazette, these regulations clarify that while employers own corporate accounts, this ownership does not permit unlimited access to personal data. Employers must demonstrate a legitimate purpose and ensure monitoring methods are relevant and proportionate. Accessing the actual content of communications is categorized as a more significant intervention than reviewing metadata or traffic logs.

To comply, employers must provide clear, specific prior notification to staff regarding the purpose, legal basis, scope, methods, and data retention periods of any audit. General statements such as ‘corporate emails may be monitored’ are no longer sufficient. This scope includes corporate email, internal messaging applications, customer relationship management systems, and meeting platform recordings.

Furthering these protections, the Regional Court of Justice (BAM) issued a landmark ruling ordering the reinstatement of two employees fired after their private WhatsApp messages were discovered. The court ruled that private, encrypted communications do not constitute valid grounds for termination unless they are proven to disrupt workplace operations. The KVKK also reaffirmed that secret surveillance is considered unlawful, emphasizing that employers must provide clear, prior notification before conducting any monitoring.

## Timeline

### 2026-10-10: Turkish courts issue landmark rulings on digital privacy and labor rights

Turkish courts and the KVKK have issued landmark rulings protecting employee digital privacy, ruling against dismissals based on private WhatsApp messages and undated resignation documents.

14 sources. https://clstr.news/cluster/yargtay-rules-secret-whatsapp-monitoring-inadmissible-as-legal-evidence

### 2026-10-08: KVKK restricts employer monitoring of corporate communications

Turkey's KVKK has introduced new rules limiting employer monitoring of corporate emails and messaging, requiring clear prior notification and ensuring all audits are proportionate and legitimate.

5 sources. https://clstr.news/cluster/kvkk-restricts-employer-monitoring-of-corporate-communications

### 2026-10-04: KVKK processed 69,000 personal data applications since 2017

Turkey's Personal Data Protection Authority (KVKK) has resolved approximately 69,000 data privacy applications since 2017, according to President Faruk Bilir.

2 sources. https://clstr.news/cluster/kvkk-processed-69000-personal-data-applications-since-2017

---
Cite as: Turkey Personal Data Protection Authority activities. CLSTR, https://clstr.news/situations/turkey-personal-data-protection-authority-activities