10 October 2026 · Probuddy Etik Hat Team

On 8 October 2026, Turkey’s Official Gazette published Principle Decision No. 2026/2035 of the Personal Data Protection Board, which ties employers’ authority to monitor workplace communications to clear criteria. The decision does not directly regulate whistleblowing systems. It does, however, draw new boundaries around the tool most often used in internal investigations that follow a report: the review of employee correspondence.

In many organisations, the first reflex when an ethics allegation surfaces is predictable: look at the emails and messages of the people involved. The reflex is understandable, because the evidence often sits in that correspondence. Since 8 October, however, when, on what grounds and within what limits this step may be taken is no longer a matter of habit. It is a compliance question.

This article sets out the core principles of the decision, its likely implications for post-report investigations, the role a well-recorded report plays in that process, and the points organisations should review now.

What does the decision regulate?

The decision rests on one central finding: the fact that a communication tool belongs to the employer, or is used in the workplace, does not in itself grant unlimited and absolute monitoring authority. The Board bases this finding on rulings of the Turkish Constitutional Court and the European Court of Human Rights. Those rulings tie the employer’s monitoring authority to prior notice, a legitimate purpose, proportionality and the priority of less intrusive means.

The scope is not limited to corporate email. Internal messaging applications, corporate instant messaging accounts, customer relationship and ticketing systems, and the chat and recording areas of meeting platforms are all listed among the channels that may be subject to monitoring. The Board also stresses that reviewing traffic and log records alone, without ever accessing content, is in itself an act of personal data processing.

Of the decision’s sixteen articles, those that intersect most directly with post-report investigations are the following:

PrincipleArticleWhat it means in practice
No unlimited monitoring1Even where the tool belongs to the company, monitoring is subject to the processing conditions, general principles, notice and data security obligations of the Personal Data Protection Law (KVKK).
Technical access is not legal authority4Technical privileges over a device, session or system do not confer a right to access correspondence in an employee’s personal accounts.
Detailed privacy notice6, 7A general statement such as “corporate email may be monitored” is not enough. The legal basis, purpose, scope, method, the circumstances in which content may be accessed and the retention period must be stated explicitly.
Explicit consent is not the primary basis8Given the power imbalance in the employment relationship, explicit consent should not, as a rule, be treated as the primary legal basis.
Gradual approach10Where the purpose can be achieved by less intrusive means, more intrusive methods may not be used. Access to content arises only in exceptional cases where traffic data proves insufficient.
Concrete suspicion for content11Content may be reviewed only where there is concrete suspicion, and only to the extent of the allegation. Open-ended, general and continuous review is to be avoided.
Third-party data12Correspondence may contain data about counterparties, including special categories of personal data. The impact of monitoring on these individuals must be taken into account.
Ban on covert monitoring13Covert monitoring without prior notice, and tools that record all of an employee’s activity indiscriminately, are unlawful.
Restricted access and logging14Only a limited number of authorised personnel may access the data. Access logs must be kept, and those with access must be bound by confidentiality obligations.

The decision also subjects the handling of former employees’ accounts to a separate assessment (Article 15). It further notes that, where non-compliance is established, administrative action will be taken under Article 18 of the KVKK (Article 16).

What does this mean for post-report investigations?

The decision makes no reference to ethics hotlines or whistleblowing systems. Yet an internal investigation launched after a report is one of the most typical examples of the monitoring activity it describes. The observations below address that intersection and do not constitute legal advice.

The concrete suspicion threshold

The concrete suspicion required for a content review often originates in a report. Not every report carries the same weight, however. There is a clear difference between information circulating in the corridors, whose source and timing cannot be traced and which amounts to little more than “something is going on”, and a report with a clear date, location, subject and, where available, supporting evidence.

Whether a particular report amounts to concrete suspicion is a legal question to be assessed case by case. Whether the organisation holds a record capable of supporting that assessment is a process question. The answer to the second directly shapes the answer to the first.

Limited to the allegation

The decision requires content review to be limited to the allegation. In practice, this means the scope of the investigation should be derived from the allegation itself. If the allegation concerns correspondence with a specific supplier, at a specific branch, during a specific period, the investigation should not extend to a whole department’s correspondence over a year.

The precondition for narrowing the scope is that the allegation has been recorded clearly from the outset. A vague allegation leads to a vague investigation, and a vague investigation risks turning into exactly the kind of general, continuous content screening the decision explicitly asks organisations to avoid.

A gradual approach

The decision gives priority to less intrusive methods. For a post-report investigation, this broadly translates into the following sequence:

  1. Assess the record of the allegation and any evidence attached by the reporter.
  2. If necessary, review traffic and log records without accessing content.
  3. Only in exceptional cases where traffic data is insufficient and access is strictly necessary, access content within the limits of the allegation.

Each step up should be supported by a written justification. The decision also states that where misuse can be prevented through technical measures such as filtering or blocking, no general right of monitoring arises for the employer.

Protecting reporters and witnesses

The decision points out that correspondence frequently contains the personal data of counterparties, and that the impact of monitoring on third parties must be considered. In whistleblowing investigations, those third parties may include witnesses and the reporter.

A broadly scoped review of correspondence can also expose the reporter’s identity. That is not only a data protection risk. It directly undermines the organisation’s commitment to preventing retaliation. A narrow, well-justified investigation is, at the same time, an investigation that protects the reporter.

A well-recorded report defines the limits of an investigation from the start

The criteria introduced by the decision turn the question of how a report is received from an operational detail into a substantive one. The quality of a report’s record determines whether an investigation is opened, what is examined and what is not, and how those choices can be explained later.

Measured against the criteria the decision sets, the difference between a report delivered as free text, verbally or through scattered channels and a structured report record can be summarised as follows:

CriterionUnstructured reportStructured report record
SubjectA general complaint or rumourAn allegation recorded under a predefined category
Location and unitOften unclearSpecified through a branch or unit field
EvidenceScattered across separate channels, if anyAttached to the record as documents, images or screenshots
TimingWhen the report was made may be disputedSubmission time and every stage timestamped
Effect on investigation scopeScope remains unclear and tends to expandScope can be derived from the allegation and narrowed
Explainability after the factThe rationale for decisions has to be reconstructedWhich step was taken and why can be traced from the record

This table is a process comparison, not a legal classification. Even so, most of the information needed to apply criteria such as concrete suspicion, limitation to the allegation and a gradual approach is created when the report is first recorded. If that first record is weak, every subsequent step is taken either too broadly or too cautiously.

Access, authority and audit trail: an ethics hotline is also a data processing activity

Article 14 of the decision requires access to data obtained from correspondence to be restricted to a limited number of personnel authorised for that task. It also requires access rights to be defined by job description, access logs to be kept and those with access to be bound by confidentiality obligations.

These requirements speak the same language as the core design principles of a well-built ethics hotline. An ethics hotline is itself a personal data processing activity, and the data it handles, concerning the parties to an allegation, witnesses and the reporter, is often of the most sensitive kind.

Organisations should therefore review not only their correspondence monitoring procedures but also the access rules for their report records, against the same criteria:

  • Who can see it? Is it defined which roles can access report content and information about the reporter, and to what extent?
  • Who did what? Is every view, update and decision on a record logged in a way that cannot later be altered?
  • Why was it accessed? Is access authority based on a job description, or on hierarchical position?
  • How long is it kept? Is there a defined retention period for report and investigation data, and a destruction procedure for data whose retention period has expired?

However carefully a correspondence review following a report is designed, if the report record itself is open to a wide circle within the organisation, the balance the decision seeks to protect has been broken through another door.

What organisations should review now

The decision has been announced publicly in the Official Gazette and on the Authority’s website, and organisations are expected to assess their current practices against it. The list below offers a starting point that compliance, human resources and ethics committee teams can work through together:

  • Rewrite the employee privacy notice with respect to the monitoring of communication channels. Distinguish between traffic and content monitoring, and state clearly when content may be accessed and how long data will be retained (Articles 6, 7).
  • Make the rules on personal use of work tools clear, understandable and communicated to employees (Articles 2, 3).
  • Add a graduated roadmap to the internal investigation procedure. Require a written justification for every step from record and evidence review to traffic data, and from traffic data to content (Article 10).
  • Record who decided to begin a content review and on the basis of what concrete suspicion (Article 11).
  • Tie access to correspondence data and report records to job descriptions, keep access logs and bind those with access to confidentiality obligations (Article 14).
  • Review any monitoring practices that rely on explicit consent with your legal counsel (Article 8).
  • Redefine the processes for the corporate accounts of departing employees (Article 15).
  • Check whether reports from your ethics hotline are recorded in a way that allows the scope of an investigation to be defined: are subject, location, timing and evidence captured in the first record?
  • Define the protection of reporters’ and witnesses’ identities as a separate control step in investigation plans.

Each of these steps will be applied differently depending on an organisation’s structure, sector and existing procedures. Working with legal counsel on specific implementation is recommended.

How Probuddy Etik Hat fits into this picture

Since 2018, Probuddy Etik Hat has provided organisations with an independent and impartial ethics hotline and report management infrastructure. Many of the principles the decision emphasises are already reflected in the platform’s design:

  • Structured report records. The online reporting form works with category, content, branch and priority fields. Reporters can attach documents, images or screenshots. Reports received by phone or email are entered into the same system by our consultants, so that every report is held to a single record standard capable of defining an investigation’s scope.
  • Timestamped process. Every status change (New, Under Review, Decision, Closed) is recorded in the system with a timestamp, so it is possible to trace which step was taken and when.
  • Restricted access. Company managers cannot access the reporter’s identity. Reports are shared only with the authorised ethics committee, through encrypted channels.
  • Tamper-proof audit trail. Actions taken in the administrator panel are written to an audit log that cannot be altered afterwards.
  • Independent initial assessment. Probuddy’s expert consultants consolidate and classify reports and carry out an initial assessment independently of the organisation.
  • KVKK-compliant infrastructure. A data processing inventory, a data protection impact assessment and a right-to-erasure procedure are part of the platform. Data is stored in encrypted form on servers located in Turkey.

An ethics hotline cannot, on its own, fulfil an organisation’s obligations under the KVKK. Privacy notices, internal investigation procedures and access policies remain each organisation’s own responsibility. What a well-designed ethics hotline can do is place the most critical starting point of those obligations, the first record of a report, on solid ground.

Conclusion

Principle Decision No. 2026/2035 turns “let’s look at their emails” from a reflex into a decision that must be justified. This shift does not make report management harder. On the contrary, it makes the value of well-recorded, narrowly scoped and traceable investigations visible.

The real question for organisations now is this: when a report comes in, who draws the boundaries of the investigation, on what basis, and can that decision be demonstrated afterwards?

To assess your ethics hotline processes in this light and discuss how Probuddy Etik Hat can be tailored to your organisation, get in touch with us: probuddy.com.tr · +90 850 304 7595 · info@probuddy.com.tr

Sources

This article is provided for general information purposes only and does not constitute legal advice. Please consult your legal counsel regarding practices specific to your organisation.