[CLSTR]
< Back to situation

[REVISION HISTORY]

Turkey Personal Data Protection Authority activities

Updated 1 time since CLSTR started tracking revisions of this situation.

What changed

2026-10-08 07:21 UTC → 2026-10-11 10:55 UTC · added removed

The Turkish Personal Data Protection Authority (KVKK) has reported significant activity regarding data privacy enforcement and regulation. Faruk Bilir, President of the KVKK, announced that the institution has processed approximately 69,000 applications concerning personal data protection since 2017, out of a total of 72,500 applications received. The authority conducts investigations into complaints to uphold constitutional rights to privacy, which can result in administrative fines. Building on its regulatory role, the KVKK has issued new rules specifically addressing the monitoring of employee communications. While employers maintain ownership of corporate accounts, Published in the new Official Gazette, these regulations state clarify that while employers own corporate accounts, this ownership does not permit unlimited access to personal data. Employers must now demonstrate a legitimate purpose and ensure monitoring methods are relevant and proportionate. Accessing the actual content of communications is categorized as a more significant intervention than reviewing metadata or traffic logs. To comply, employers are required to must provide clear, specific prior notification to staff regarding the purpose, legal basis, scope, methods, and methods data retention periods of any audit. These regulations apply to various digital tools, including General statements such as ‘corporate emails may be monitored’ are no longer sufficient. This scope includes corporate email, internal messaging applications, customer relationship management systems, and meeting platform recordings. Furthering these protections, the Regional Court of Justice (BAM) issued a landmark ruling ordering the reinstatement of two employees fired after their private WhatsApp messages were discovered. The court ruled that private, encrypted communications do not constitute valid grounds for termination unless they are proven to disrupt workplace operations. The KVKK also reaffirmed that secret surveillance is considered unlawful, emphasizing that employers must provide clear, prior notification before conducting any monitoring.

Versions

  1. 2026-10-11 10:55 UTC Turkey Personal Data Protection Authority activities
  2. 2026-10-08 07:21 UTC Turkey Personal Data Protection Authority activities

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.