The decision first
With principle decision 2026/2035 of 16 September 2026 (Official Gazette 8 October 2026, no. 33394), the Personal Data Protection Board set out the procedures and principles employers must follow when auditing the corporate e-mail accounts assigned to employees and the other communication channels used to carry out work. Internal messaging applications and file areas are also within scope, depending on the facts of the case. Every scan of employees’ e-mail, files and chats is an audit activity within the meaning of this decision.
The full text is on the Authority’s website: Principle decision 2026/2035 (kvkk.gov.tr, in Turkish).
This page is not legal advice. Assess with your own legal adviser how the decision applies to your organisation; Compliance Agent does not replace that assessment, it helps you verify adherence to your organisation’s policies.
1. Notice: concrete, in advance, understandable
What the decision says. Employees must be informed before any audit, clearly, understandably and concretely: the legal ground and purpose of the audit, its scope (traffic data or content), the cases in which content will be accessed, the method, the retention period, the consequences, who will see the data and the data subject’s rights. A general statement or a general undertaking signed by the employee is not enough. The decision also states that, because of the imbalance of power between employer and employee, the employee’s explicit consent should as a rule not be the primary legal ground for such audits.
How Compliance Agent supports it. No scan can run without the employee’s permission. Each employee gives permission through a personal link your organisation sends; who has given permission and who is still pending is visible in the product. This permission does not replace the notice and is not a legal ground: you prepare your notice and your permission mechanism for your own organisation, and you decide with your legal adviser which legal ground you rely on.
2. Business and private use kept apart
What the decision says. Whether corporate communication tools may be used for private purposes, and on what conditions, must be decided in advance, transparently, and announced to employees. The audit is limited to business communication; where business and private communication cannot be told apart, the audit is interpreted more narrowly.
How Compliance Agent supports it. You set the scope: user group selection, date range and rule selection. The product cannot separate business from private correspondence inside a mailbox; you make that distinction through your policy and your choice of scope. Where it cannot be made, keep the scope narrower.
3. Gradual: content as the last resort
What the decision says. Auditing is gradual by principle. Access to content arises only in exceptional cases where a review of traffic data is not enough; it is done where there is concrete suspicion and limited to the allegation. Content review that is indeterminate in scope, general or ongoing is to be avoided. Where preventive technical measures (filtering, blocking) are possible, they come first.
How Compliance Agent supports it. The product’s rules work by reading content; whether a content scan is necessary and proportionate is therefore your organisation’s assessment. The product offers the tools that narrow the scope: Safe Scan, which touches nothing; trying a rule on sample text before scanning (Test rules); user group and date range selection; and Reveal, which asks for a duration, a reason and a request number before full content is shown. A scan is never hidden or unannounced, never runs without pause and never processes each message as it arrives.
4. Limited access and records
What the decision says. Access to the data must be limited to a small number of authorised staff, tied to their job description; access records must be kept; those staff must be bound by confidentiality; and the data obtained must be kept only as long as the purpose requires.
How Compliance Agent supports it. Three roles: Admin, Security Manager and Reporter; the roles are Microsoft Entra application roles, and we recommend limiting access to the results to the fewest people necessary. The results show the rule that matched; to see the full content, Reveal asks for a duration, a reason and a request number, and every view is written to the audit log. Every administrative step is recorded; Verify integrity checks that no entry has been changed or is missing. Results, logs, the audit log and the OneDrive copies taken before an action stay in your own Azure storage; you manage the retention period according to your organisation’s policy.
5. Not hidden, but announced
What the decision says. Hidden review, and tools that record every operation indiscriminately, are unlawful.
How Compliance Agent supports it. It does not scan without the employee’s permission; the permission is given through a personal link, can be withdrawn by the employee, and its withdrawal is recorded in the audit log too. Scans are runs you start, in the periods stated in your notice to employees and announced in advance. The product is not designed to look into a particular employee.
6. When the employment relationship ends
What the decision says. When the employment relationship ends the account is closed; forwarding and archiving are kept limited and justified; data that must be retained is kept closed to access.
How Compliance Agent supports it. Whatever action your organisation takes on a leaver’s data under its own policy is the organisation’s decision; the product does not take that decision automatically and records every step.
Third parties and sensitive data
E-mail and chats also contain personal data of the other party to the correspondence, for example senders outside the organisation; the employee’s permission does not cover those people. Attachments and message bodies may contain sensitive personal data. The decision expects data whose review is not necessary to be left out of scope; narrow the scope with user group, date range and rule selection, and address this risk in your notice.
Who it is for
Banking · Insurance · Holding groups · Healthcare · Retail
In healthcare and similar sectors the likelihood of sensitive personal data in correspondence is high; narrow the scope and the notice accordingly.
How to buy
Through Azure Marketplace, per seat; billed by Microsoft through your Azure billing account. It deploys in about 10 minutes, followed by your Global Administrator’s one-time setup step. Pricing model · How it works · FAQ