Home About Us Services Awards Team Insights Career Contact Us TÜRKÇEENGLISH Devin Patent — Istanbul
Data Protection/Insights

Turkish Data Protection Board Decisions — October 2026: The Resolution of Principle on the Monitoring of Corporate E-mail and Work Communication Channels and the Breach Notifications of 7 October 2026

Kişisel Verileri Koruma Kurulu Kararları — Ekim 2026: Kurumsal E-Posta ve İş İletişim Kanallarının Denetlenmesine İlişkin İlke Kararı ve 7 Ekim 2026 Tarihli İhlal Bildirimleri
Published12 October 2026
Reading time17 min
PDF
← All Insights
CategoryData Protection
Published12 October 2026
Contents01Introduction02Decisions and Announcements of the Period03Conclusion
Devin Law & IP

This subject falls outside trademark and patent attorneyship. Legal services in this field are provided by our law firm, Devin Law & IP.

Go to devinlaw.com.tr →
SummaryÖzet

This legal update reports the resolution of principle No. 2026/2035 dated 16 September 2026 of the Personal Data Protection Board (“the Board”) and seventeen data breach notifications published on the website of the Personal Data Protection Authority (“the Authority”) pursuant to the Board's decisions dated 7 October 2026. The resolution of principle was published in the Official Gazette No. 33394 dated 8 October 2026 and was announced on the Authority's website on the same date. The update covers announcements published on the Authority's website between 5 October 2026 and 11 October 2026.

01
Introduction

The Board's resolution of principle No. 2026/2035 concerns the procedures and principles to be observed in the monitoring of communication channels used for the performance of work, in particular corporate e-mail accounts allocated to employees by employers. The decision records the finding that, following the examination of reports and complaints submitted to the Authority, these channels were being monitored, the content of correspondence was being accessed, traffic and log records were being examined and the data obtained were being used in disciplinary proceedings or in proceedings relating to the termination of the employment contract, while employees were not informed of these activities in a sufficient, clear and specific manner. The decision lists the matters to be taken into account by employers under fourteen headings.

On 7 October 2026, the Board decided to publish seventeen data breach notifications, and the notices were published on the Authority's website on the same date. In six of the notifications the breach is attributed to a ransomware attack, and in three to the encryption of data following external access to the data controller's systems. In seven notifications, the breach occurred in the systems of a data processor from which the data controller receives services. All of the notices state that the examination of the matter is ongoing. The publication decisions do not include any sanction in respect of the breaches.

Principle decision No. 2026/2035 on monitoring corporate e-mail and business communication channels was published in the Official Gazette of 8 October 2026; the Board published seventeen data breach notifications by decisions dated 7 October 2026.
02
Decisions and Announcements of the Period
Resolution of Principle on the Monitoring of Corporate E-Mail and Business Communication Channels

Particulars of the Decision and the Findings on Which It Is Based

The resolution of principle is entitled “On the Procedures and Principles to be Observed in the Monitoring of Communication Channels Used for the Performance of Work, in Particular Corporate E-Mail Accounts Allocated to Employees by Employers”. The decision states that corporate e-mail accounts are not merely a means of communication, but constitute a source of data containing personal data relating to the employee's professional and, in some cases, personal network of relationships, working patterns, communication activities and the content of correspondence.

The Board characterised the monitoring of these accounts and of other communication channels as a personal data processing activity requiring a fair balance to be struck between the employer's powers arising from the employment contract and the right of management, on the one hand, and the employee's privacy of private life, right to request the protection of personal data and freedom of communication, as guaranteed by Articles 20 and 22 of the Constitution, on the other.

The Board's assessment: The decision states that monitoring activities are subject to the conditions for processing personal data and the general principles laid down in Law No. 6698 on the Protection of Personal Data (“PDPL”), and that, where relevant, they also require compliance with the obligation to inform and the data security obligations; it includes the following statement: “The fact that the means of communication belongs to the employer or is used in the workplace does not confer on the employer an unlimited power of monitoring over employees' communication activities.”

Distinction Between Business Use and Private Use

According to the decision, in determining the scope of monitoring, account must be taken of the purpose for which the means of communication was allocated and of the rules governing its use. The employer may, within the scope of its right of management, lay down rules on the private use of workplace means of communication. Those rules must be clear, comprehensible and capable of being known by the employee. The decision states that, even where private use is prohibited, the employer's power of monitoring is limited by the principle of proportionality, and that, where business use and private use cannot be definitively separated from one another, the scope of the power of monitoring must be assessed more narrowly.

The Board stated that technical access authority and legal access authority must be distinguished from one another. According to the decision, the fact that the employer has the technical means of access to a particular device, session, network or corporate system does not mean that it may freely access the content of correspondence held in the employee's personal e-mail account, personal instant messaging application, social media account or similar private communication spaces.

Prior Notice and the Obligation to Inform

The decision states that the fact that employees have been given prior notice of the monitoring activity to be carried out is one of the elements of importance in determining the lawfulness of the monitoring. The Board stated that the notice required in the case-law of the Constitutional Court and the obligation to inform governed by Article 10 of the PDPL are not the same concepts. According to the decision, a duly provided information notice which contains the elements prescribed in Article 10 of the PDPL and gives clear and specific information on the purpose, scope and method of the monitoring activity is capable of satisfying the requirement that the employee be given prior notice of the monitoring.

The information notice to be provided by the employer must set out, in a clear, comprehensible and specific manner, the legal basis, purpose, scope and method of the personal data processing activity, the circumstances in which the content of communications may be accessed, the retention period of the data and the rights of data subjects under Article 11 of the PDPL. The decision states that merely giving employees a general notice to the effect that the corporate e-mail account may be monitored by the employer will not, depending on the particular circumstances of the case, be sufficient in terms of prior notice and will not of itself lead to the conclusion that the obligation to inform has been fulfilled.

The legislation provides: Under Article 10(1) of the PDPL, the data controller or the person authorised by it is obliged, at the time the personal data are obtained, to inform data subjects of the identity of the data controller and of its representative, if any, the purpose for which the personal data will be processed, to whom and for what purpose the processed personal data may be transferred, the method and legal basis of the collection of personal data, and their other rights listed in Article 11.

Explicit Consent

The decision states that, having regard to the state of dependency in the employment relationship and the balance of power between the parties, it is not possible, as a rule, for the employee's explicit consent to be “accepted in every case as the primary legal basis” for e-mail monitoring. Where explicit consent is relied upon, whether the consent was given of the employee's own free will must be assessed separately in the light of the circumstances of the particular case. According to the decision, the existence of valid explicit consent or of another condition for processing personal data laid down in the PDPL likewise does not confer on the employer an unlimited power of monitoring.

Proportionality, Graduated Monitoring and Content Monitoring

According to the decision, monitoring activities must be carried out, in accordance with the general principles set out in Article 4 of the PDPL, lawfully and in conformity with the rules of good faith, for specified, explicit and legitimate purposes and in a manner that is relevant, limited and proportionate to that purpose. The personal data obtained must not be retained for longer than is necessary for the purpose of the processing. The decision states that monitoring activities must be based on a graduated approach and that, where the employer is able to achieve the legitimate aim pursued by a less intrusive method, a more severe method of monitoring must not be resorted to.

The Board's assessment: As regards content monitoring, the decision states that the examination of content held in the e-mail or other means of communication allocated to the employee is to be resorted to “as a rule only where there is a specific suspicion or a legitimate purpose connected with a particular event, and in a manner limited to the purpose of the monitoring”. The decision states that content examinations which are of indeterminate scope, general and continuous in nature must be avoided.

Special Categories of Data, Access Authority and Termination of the Employment Relationship

The decision states that, in content monitoring, account must be taken of the fact that the content examined or its attachments may contain special categories of personal data within the meaning of Article 6 of the PDPL. The Board stated that employees' communications may also contain personal data belonging to the other parties to the communication or to other third parties, and that the effects which the monitoring may have on those persons must also be taken into consideration.

According to the decision, access to the data obtained from these channels must be restricted to a specified number of personnel who have been assigned duties and authority in this regard. Access authorisations must be determined in line with job descriptions, records of access operations must be kept and the confidentiality obligations of persons accessing the data must be secured. After the employment relationship has ended, the legal basis of the personal data processing activities relating to the corporate e-mail account and to the data obtained or held within the scope of that account must be assessed separately. The decision states that the termination of the employment relationship does not mean that the data in question may be accessed or processed indefinitely.

Operative Part of the Decision

The Board decided to inform the public that, where non-compliance with the obligations listed is established, the necessary examinations and assessments will be carried out having regard to the particular circumstances of the case and action will be taken against the data controllers concerned pursuant to the provisions of Article 18 of the PDPL. Article 18 of the PDPL governs the administrative fines applicable in the event of non-compliance with the obligations laid down in the PDPL.

Breach Notifications Based on Ransomware and the Encryption of Data

Four Notifications Concerning the Breach of 30 September 2026: Call Records and Personnel Data

By the Board's decisions Nos. 2026/2204, 2026/2205, 2026/2206 and 2026/2207 dated 7 October 2026, the notifications of PCT Yazılım Danışmanlık Telekomünikasyon Pazarlama Ticaret Anonim Şirketi, PCX Operasyon Yazılım ve Danışmanlık Hizmetleri Anonim Şirketi, Procat Teknoloji Danışmanlık Hizmetleri Anonim Şirketi and Procatcx Operasyon Yazılım ve Danışmanlık Hizmetleri Anonim Şirketi, respectively, were published. All four notifications state that the breach arose as a result of a ransomware attack on the data controller's systems, that it occurred on 30 September 2026 and that it was detected on the same day.

According to the notifications, the data considered possibly to have been subject to the breach are human resources personnel information, including employees' performance evaluation data and the data appearing on copies of old-format identity cards held in personnel files, the curricula vitae of persons who had submitted job applications, and call detail records and call voice recordings within the scope of call centre services. The notifications state that there has as yet been no finding that personal data were transferred outside, and that the number of affected persons and records has not yet been definitively determined.

Two Notifications from the University and Retail Sectors

The notification of Yıldız Teknik Üniversitesi, published by the Board's decision No. 2026/2203 dated 7 October 2026, states that the data controller's virtualisation infrastructure and the servers running on it were affected by a ransomware attack. The breach began on 1 October 2026 and was detected on the same day. The affected groups of data subjects are students, staff and visitors. The notification states that, according to the existing records, the number of data subjects who may have been affected by the breach is approximately 140,000 students and 4,500 staff, that the number relating to visitors has not yet been determined and that the affected categories of personal data could not be determined.

The notification of Monnalisa Bebek Giyim San ve Tic AŞ, published by the Board's decision No. 2026/2210 dated 7 October 2026, states that the breach occurred as a result of a ransomware attack, that it began on 28 September 2026, ended on 29 September 2026 and was detected on 29 September 2026. According to the notification, the method by which the attack was carried out and the security vulnerability exploited could not be definitively determined. The notice records that the affected group of data subjects and the categories of personal data were not stated in the notification.

Encryption of Data Following External Access to Systems

By the Board's decisions Nos. 2026/2214, 2026/2215 and 2026/2216 dated 7 October 2026, the notifications of Gür Grup İnşaat San.ve Tic. Anonim Şirketi, Medikalyapı Sağlık Yatırımları Anonim Şirketi and Ortadoğu Holding Anonim Şirketi, respectively, were published. All three notifications state that the breach began on 3 October 2026 and was detected on the same day, and that external access was gained to the data controller's systems and the data were encrypted and rendered inaccessible.

In the Medikalyapı and Ortadoğu Holding notifications, the affected groups of data subjects were reported as employees, users and customers, and the affected data categories as location, personnel, legal transaction, risk management, finance, professional experience, marketing, and visual and audio recordings. In the Gür Grup notification, the affected groups are employees and users, and the affected categories are location, personnel, and visual and audio recordings. All three notifications state that the number of persons who may have been affected could not be estimated.

Publications of 7 October 2026: ransomware and encryption of data (Board decision No. · Data controller · Nature of the breach)

  • 2026/2203 — Yıldız Teknik Üniversitesi — Ransomware attack
  • 2026/2204 — PCT Yazılım Danışmanlık Telekomünikasyon Pazarlama Ticaret Anonim Şirketi — Ransomware attack
  • 2026/2205 — PCX Operasyon Yazılım ve Danışmanlık Hizmetleri Anonim Şirketi — Ransomware attack
  • 2026/2206 — Procat Teknoloji Danışmanlık Hizmetleri Anonim Şirketi — Ransomware attack
  • 2026/2207 — Procatcx Operasyon Yazılım ve Danışmanlık Hizmetleri Anonim Şirketi — Ransomware attack
  • 2026/2210 — Monnalisa Bebek Giyim San ve Tic AŞ — Ransomware attack
  • 2026/2214 — Gür Grup İnşaat San.ve Tic. Anonim Şirketi — Encryption of data following external access
  • 2026/2215 — Medikalyapı Sağlık Yatırımları Anonim Şirketi — Encryption of data following external access
  • 2026/2216 — Ortadoğu Holding Anonim Şirketi — Encryption of data following external access
Notifications Concerning Data Processor Systems and the Restaurant Chain Notifications

Data Processors Providing Call Centre and Voice Recording Services

By the Board's decision No. 2026/2212 dated 7 October 2026, the notification of D Elektronik Şans Oyunları ve Yayıncılık A.Ş. was published, and by decision No. 2026/2211 that of 4 Race Teknoloji ve Yazılım A.Ş. Both notifications state that a cyber attack was carried out on the systems of the data processor from which call centre services are received and that the data were encrypted and rendered inaccessible, and that the data processor, upon experiencing a service interruption in its system on 30 September 2026, identified the situation and informed the data controller.

The notifications state that the initial examinations revealed no finding that data were transferred outside, that, having regard to the length of time the attacker was present in the systems and the shared structure of the infrastructure, the possibility of unauthorised access could also not be entirely excluded, and that the definitive outcome will be clarified by a digital forensic examination. The affected data are call voice recordings and call detail records. According to the notifications, the voice recordings may, depending on the content of the conversation, also contain identity verification information, such as date of birth and Turkish identity number, and transaction information. The notifications state that, since the support process for visually impaired members is also conducted through the call centre, a limited number of conversations may contain statements relating to disability status.

The notification of GIG Sigorta AŞ, published by the Board's decision No. 2026/2195 dated 7 October 2026, states that it was detected on 30 September 2026 that the data processor from which the data controller receives services in respect of technological infrastructure, IVR installation and the archiving of voice recordings had been subjected to a cyber attack. According to the notification, one day's voice recording data were encrypted and the voice recordings relating to 161 calls could not be accessed. The affected data are identity, contact and customer transaction data belonging to customers.

E-Commerce and Restaurant Chain Notifications

The notification of Hüşyar Tekstil Paz. İth. İhr. San. Tic. Ltd. Şti., published by the Board's decision No. 2026/2213 dated 7 October 2026, states that the breach occurred as a result of unauthorised access being gained to a server in the data processor's systems holding the data controller's data, by exploiting a security vulnerability in a third-party software library in use. The breach was detected upon the notification made by the data processor on 29 September 2026. The affected data are the name, surname, postal address, e-mail address, telephone number and stored password values of store customers, and admin panel user accounts and stored password values.

By the Board's decisions Nos. 2026/2200, 2026/2197 and 2026/2198 dated 7 October 2026, the notifications of Smart Delivery Pizza Yemekçilik Gıda E-Ticaret Reklamcılık ve Ticaret Limited Şirketi, DDP Temizlik Pizza Gıda Sanayi ve Ticaret Limited Şirketi and Deniz Pizza Restoranları ve Ticaret Limited Şirketi, respectively, were published. All three notifications state that the breach occurred as a result of unauthorised access being gained to the data processor's systems holding the data controller's data and that it was detected upon the data processor's notification. The date of the data processor's notification is 30 September 2026 for Smart Delivery and Deniz Pizza, and 1 October 2026 for DDP.

The notification of Dodo Brands International FZCO, published by the Board's decision No. 2026/2199 dated 7 October 2026, states that the breach occurred as a result of unauthorised access being gained to the systems holding the data controller's data and that it was detected on 28 September 2026. In these four notifications, the affected groups of data subjects are customers and employees, and the affected data categories are identity, contact, location, customer transaction and finance information. All four notifications state that work to determine the number of affected data subjects is continuing. The Dodo Brands notification states that data subjects will be informed through the Dodo Pizza mobile application.

Publications of 7 October 2026: call centre, e-commerce and restaurant chain notifications (Board decision No. · Data controller · Nature of the breach)

  • 2026/2195 — GIG Sigorta AŞ — Cyber attack on data processor; voice recording data encrypted
  • 2026/2197 — DDP Temizlik Pizza Gıda Sanayi ve Ticaret Limited Şirketi — Unauthorised access to data processor's systems
  • 2026/2198 — Deniz Pizza Restoranları ve Ticaret Limited Şirketi — Unauthorised access to data processor's systems
  • 2026/2199 — Dodo Brands International FZCO — Unauthorised access to systems holding the data controller's data
  • 2026/2200 — Smart Delivery Pizza Yemekçilik Gıda E-Ticaret Reklamcılık ve Ticaret Limited Şirketi — Unauthorised access to data processor's systems
  • 2026/2211 — 4 Race Teknoloji ve Yazılım A.Ş. — Cyber attack on call centre data processor; data encrypted
  • 2026/2212 — D Elektronik Şans Oyunları ve Yayıncılık A.Ş. — Cyber attack on call centre data processor; data encrypted
  • 2026/2213 — Hüşyar Tekstil Paz. İth. İhr. San. Tic. Ltd. Şti. — Unauthorised access to data processor's server via third-party software library vulnerability
Obligations Relating to Breach Notification

The legislation provides: Article 12(5) of the PDPL provides: “Where the processed personal data are obtained by others through unlawful means, the data controller shall notify the data subject and the Board of this situation as soon as possible. Where necessary, the Board may publish this situation on its own website or by any other method it deems appropriate.”

Pursuant to the Board's decision No. 2019/10 dated 24 January 2019, the data controller must notify the Board without delay and within 72 hours at the latest from the date on which it becomes aware of the breach, and the data processor must notify the data controller without delay of any breach occurring within its organisation.

03
Conclusion

The Board's resolution of principle No. 2026/2035 dated 16 September 2026 was published in the Official Gazette No. 33394 dated 8 October 2026. The decision states that the monitoring of corporate e-mail accounts and of other communication channels used for the performance of work is subject to the processing conditions and general principles in the PDPL and to the obligation to inform and the data security obligations. The decision contains points on the distinction between business use and private use, the separation of technical and legal access authority, prior notice, the scope of the information notice, explicit consent, graduated monitoring, content monitoring, access authorisation and the termination of the employment relationship. The Board announced that, where non-compliance with these obligations is established, action will be taken pursuant to Article 18 of the PDPL.

By its decisions Nos. 2026/2195, 2026/2197, 2026/2198, 2026/2199, 2026/2200, 2026/2203, 2026/2204, 2026/2205, 2026/2206, 2026/2207, 2026/2210, 2026/2211, 2026/2212, 2026/2213, 2026/2214, 2026/2215 and 2026/2216 dated 7 October 2026, the Board published seventeen data breach notifications. In six of the notifications a ransomware attack was reported and in three the encryption of data following external access to the data controller's systems, while in seven the breach occurred in data processor systems. A figure for the number of affected data subjects appears only in the Yıldız Teknik Üniversitesi notification, in which the number is stated as approximately 140,000 students and 4,500 staff. All of the notices state that the examination of the matter is ongoing.

Full briefing noteDownload the bilingual PDF version of this briefing note.
Download PDF

Related reading

Data ProtectionTurkish Data Protection Board Decisions — October 2026: Form of Response to Data Subject Applications and the Breach Notifications of 30 September 20265 October 2026Data ProtectionLawyers' Data Protection Obligations and Breaches at Data Processors28 September 2026Data ProtectionTurkish Data Protection Board Decisions — August 2026: Principle Decisions, Data Processing for Marketing Purposes and Workplace Surveillance5 September 2026