In a claim of violation, it must first be established who accessed which communication, by what method and for what purpose. Wiretapping by public authorities, an employer's review of e-mails and a private person's spreading of messages are subject to different legal routes. A criminal complaint, a KVKK application and a labor action are not substitutes for one another; the periods of each must be tracked separately. For an AYM application, the appropriate ordinary remedies must be exhausted and the thirty-day application period must be preserved. 2 3
What is the scope of protection of freedom of communication?
Information about the communication matters as much as its content
The protection of communication is not limited to the words of the conversation. Records of who communicated, when, how often and for how long can also reveal information about a person's relationships and life. Access to content and the processing of traffic data differ in the intensity of the interference; but it cannot be said that all data processing is free simply because the content was not read. 1; 4, § 70
Whether a message is closed to third parties, the participants' expectation of confidentiality and the context of use are taken into account. A publicly visible social media post and a private message group with limited participants are not the same. That a communication has lawfully reached a recipient does not mean that the recipient may publish the message without limit. The scope and purpose of the dissemination and the relevant special regulations are assessed separately.
The confidentiality of communication may intersect with private life and the protection of personal data. The same record may be both communication content and personal data. In an application, instead of listing all the names of rights together, it should be explained which act affected which interest. Reading of messages, their use in a dismissal and their disclosure to the public may be treated as separate interferences.
Ownership of a digital device does not confer unlimited power of inspection
Who owns the telephone, computer or e-mail infrastructure matters, but it is not decisive on its own. On a device allocated for work, there may be a need for monitoring for management and security purposes. Its lawfulness is assessed together with prior information, a concrete purpose, the scope of access, lighter methods and retention conditions. 4 5
Similarly, an account being left open on a shared computer does not mean that the communication has been made public. That a password was shared earlier should not be interpreted as an unlimited and perpetual permission. The purpose for which access was given and whether it was later withdrawn are important. The applicant should collect records that show the limit of the access made, rather than the ownership of the device.
Under what conditions may public authorities monitor communications?
Legality, legitimate aim and the judge's guarantee
Article 22 of the Constitution provides special safeguards for the obstruction of communication and interference with its confidentiality. National security, public order and the other purposes listed in the article are not sufficient when invoked in the abstract. The statutory basis of the interference, the deciding authority and the persons and scope of the communication must be determined. Where delay would be harmful, the decision of the competent authority is submitted to a judge for approval within twenty-four hours; the judge announces the decision within forty-eight hours, otherwise the decision lapses automatically. 1
In covert measures, the person may be unable to object during the interference. For this reason, prior and subsequent oversight, time limits, and the use, retention and destruction of the records are particularly important. A statement that "the file is confidential" does not mean that the statutory safeguards disappear. Nevertheless, access to the file and the timing of information may be subject to statutory limitations according to the nature of the investigation.
CMK 135 is not a single measure
In telecommunications monitoring in a criminal investigation and prosecution, CMK 135–138 must be examined together. Interception, recording, the evaluation of signal information and the determination of communication do not have the same scope and conditions. For interception, recording and signal evaluation, the conditions of strong suspicion based on concrete evidence and the impossibility of obtaining evidence by other means, as well as the restriction to the relevant catalog offenses and the duration of the decision, are checked separately. The special paragraph on the determination of communication must not be overlooked by applying the same template to all measures. 6
It is important that the decision identifies the correct person and line, that the duration of the measure matches its implementation and that the reasons for extensions are concrete. That a conversation with a suspect has entered the record is different from targeting all communications of the person who spoke with the suspect. There are special provisions on communication with defense counsel, the right to refuse to testify and evidence obtained by chance. It should not be assumed that a decision obtained for one offense permits unlimited use for any other offense.
Examining past correspondence inside a phone is also not the same operation as listening to ongoing communication. For a device search and digital records, CMK 134, seizure and other relevant provisions may come into play. Instead of saying "my phone was tapped" in an application, it should be explained whether it was the operator record, live audio or the archive on the device that was examined. Wrong characterization may lead to the wrong provision and the choice of the wrong route of application.
What the Yasemin Çongar and Others decision shows about safeguards
The decision Yasemin Çongar and Others [GC], Application No. 2013/7054, January 6, 2015 deals with the legality problem of communication monitoring carried out under code names instead of real identity details. The AYM emphasized that covert interferences must be subject to clear rules and to safeguards that prevent abuse. The conclusion was reached that freedom of communication had been violated. 7
The practical value of this decision is that it shows that the examination does not end when there is a judge's decision. The information on which the decision was based and the statutory conditions of the method used are also important. However, the decision does not mean that all covert investigations or intelligence activities are prohibited. The applicant must set out the concrete deficiency of identity, authority or procedure; an abstract suspicion of being tapped does not on its own produce the same result.
Can an employer read corporate e-mail and messages?
A balance must be struck between the performance of the work and the personal sphere
An employer may have legitimate interests such as data security, protecting trade secrets, continuity of the work and preventing liability that may arise from employee conduct. The employee also has fundamental rights that continue at the workplace. These two spheres cannot be resolved with categorical formulas such as "if it is a company account, everything may be read" or "if there is personal data, no review may be carried out." 4 5
For the lawfulness of monitoring, its purpose must first be explained. If a concrete security incident is being investigated, it must be shown which incident is connected with which record. Then less intrusive methods are assessed: a connection log, a specific date range, or a review limited by subject or person may suffice. Reviewing all past messages, unrelated personal correspondence and the data of third parties requires stronger justification.
That the employee was informed in advance is important; but a general contract clause does not automatically legitimize all monitoring. The notice should explain in an understandable way which tools will be reviewed, for what purpose and to what extent. Who will carry out the review, to whom the results will be disclosed and how long they will be retained are also part of the assessment. Unnecessary circulation of the data within the workplace after the monitoring may give rise to a separate unlawfulness.
Why did the E.Ü. and Celal Oraj Altunörgü decisions end differently?
In E.Ü. [GC], Application No. 2016/13010, September 17, 2020, the termination of an employment contract after a review of corporate e-mail correspondence was assessed. The lack of clear prior notice, the failure to show the necessity of reviewing the content and the uncertainty of the scope were significant. Because the lower courts did not carry out the necessary balancing, the conclusion was reached that the right to request the protection of personal data and freedom of communication had been violated. 4, §§ 68–79
In Celal Oraj Altunörgü, Application No. 2018/31036, January 12, 2021, by contrast, it was decided that there was no violation. The AYM assessed the notice in the employment contract, the conditions of use of the corporate account, the purpose of the review and the particular features of the concrete dispute. This decision shows that notification and a limited review can change the result. At the same time, it does not give the employer a general authority to access all personal accounts. 5
Reading the two decisions together makes clear which documents should be submitted to the file: the usage policy in force on the date of the incident, the record showing that it was communicated to the employee, the decision to conduct the review, technical access logs, the scope limit, the notice of termination and the correspondence submitted to the court. It cannot be claimed that a policy prepared afterwards makes a review carried out in the past lawful by itself.
Key points of the October 2026 KVKK principle decision
The Personal Data Protection Board's principle decision of September 16, 2026, No. 2026/2035 was published on October 8, 2026. The decision emphasizes that, in the monitoring of corporate e-mail and communication channels used for work, the employer's ownership does not provide unlimited access. A general notice and the privacy notice obligation under KVKK are not the same thing. Access to content requires a concrete justification, limitation to the purpose and consideration of lighter methods. Whether explicit consent is based on free will, given the dependency in the employment relationship, must be examined separately. Authorized persons, access logs, retention and post-departure handling should also be governed by protective measures. 8
This development shows that employer policies should not consist only of the sentence "monitoring may be carried out." On the employee's side as well, the dispute should not be reduced merely to the content of the message. On what legal ground and to what extent the data is processed should be assessed separately from the validity of the termination.
Can communication be removed entirely in penal institutions?
For convicts and detainees, statutory restrictions may be foreseen because of security, crime prevention and institutional order. However, the right to communicate does not disappear. Letters, telephone and other forms of communication have different rules. Articles 66 and 68 of Law No. 5275 in particular, together with the special safeguards, should be examined. The regime for correspondence with lawyers and the competent authorities is not identical to that of an ordinary personal letter. 9
When a letter is blocked in its entirety, it must be explained which part creates which concrete risk. That the decision contains only general security language may not show that an individualized review was carried out. By contrast, if there is a specific threat, criminal organization or content affecting the security of the institution, its importance should also be assessed. The applicant should keep a copy of the letter and the blocking decision and use the relevant enforcement judgeship (infaz hâkimliği) route in time.
Under Law No. 4675, the route of complaint to the enforcement judgeship is considered against the relevant act or activity within fifteen days of learning of it and in any case within thirty days of its being carried out. An objection to the enforcement judge's decision is possible within two weeks of notification. A complaint has no automatic suspensive effect; a request for postponement or suspension in accordance with the statutory conditions is examined separately. 13
Private persons' access to and disclosure of messages
TCK 132 protects the confidentiality of communication. Different acts are regulated with respect to access by a person who is not a party to the communication, recording and disclosure of the content. Being a party to the communication does not make every disclosure lawful. Marriage, an employment relationship or friendship is not a general exception to confidentiality. Depending on the nature of the act, the confidentiality of private life, personal data and information technology offenses may also come into play. 10
When a record or message is used for the purpose of proving a right, necessity, the possibility of other evidence, the sudden development of the event, the method of obtaining it and the limit of its use are assessed concretely. It cannot be said that entering another person's account without permission with the thought "I will give it to the court" is lawful in every case. An objection of unlawful evidence must be raised separately in accordance with the procedural rules of the relevant proceedings.
If the disclosure is ongoing, focusing solely on compensation for past damage may be insufficient. Preventing the spread of the content, legally available protective measures, an application to the data controller and appropriate criminal or civil routes are assessed together. Before applying, the date, address and context of screenshots should be preserved; but in doing so, intimate content should not be redistributed unnecessarily to other persons.
Where to apply and which periods to track?
| Problem | Main route | Point to note regarding period or procedure |
|---|---|---|
| Unlawful processing of personal data | First an application to the data controller; then, if the conditions are met, a KVKK complaint | The data controller replies within thirty days at the latest; for a complaint to the Board, the thirty-day period from learning of the reply and the sixty-day period from the application in any case are taken into account. |
| Dismissal based on a review of e-mail | If the conditions for reinstatement are met, mediation and the labor court | A mediator within one month of notification of the termination; an action within two weeks of the final record of non-agreement. |
| Offense violating the confidentiality of communication | Application to the public prosecutor's office or the police | Under TCK 139 and 73, the complaint regime of the relevant offense; where it is subject to complaint, the six-month period from learning. |
| Criminal procedure decision | The relevant CMK application and objection | General objection period, unless there is a special provision, two weeks from learning. |
| Unremedied constitutional violation | AYM individual application | Effective ordinary remedies and thirty days from learning of the final decision. |
A KVKK complaint is not a general civil action that awards compensation. The Board's review and a claim for material or non-material damage serve different functions. The exceptions in the law and the type of act should also be assessed; not every communication monitoring can be made the subject of a KVKK complaint in the same way. One should not rely on one application automatically stopping the other periods. 2
In the reinstatement route, the scope of job security matters as much as the period. Not every employee can file a reinstatement action simply because their e-mail was reviewed; the relevant statutory conditions are also required. Labor receivables and compensation claims are also assessed under their own conditions. Asserting that there was a violation of communication does not automatically remove all consequences of the termination. 11
How should the application file be prepared?
First, a chronology of the access should be prepared: the allocation of the account, the notice of the policy, the incident that gave rise to the suspicion, the review, the sharing, the disciplinary action or termination, earlier applications and the final decision. Not only selected sentences of the relevant messages but also the context that explains the dispute should be preserved. It is important that technical records are not altered and that access authorizations are documented.
A claim of violation must answer four questions: What was the legal basis; what was the stated purpose; what data was actually accessed; and why did this access exceed the necessary limit? The other side's strongest defense must also be discussed. If there is an allegation of leakage of trade secrets, rather than settling for "I have a private life," it should be explained why the review was too broad or why narrower methods would have been sufficient.
An AYM application is not a new action directed against a private employer. It shows the State's obligation to protect and whether the courts examined the dispute in light of the constitutional guarantees. The necessary claims should have been raised in substance in the earlier proceedings; the courts' answers to them should be attached. Individual application through the UYAP Attorney Portal is available; the sending record and the completeness of the attachments should also be verified separately. 3 12
How is an e-mail dispute broken down in practice?
In a hypothetical case, suppose an employer, on suspicion that a customer list was sent out, reviews all correspondence in an employee's corporate account and also adds messages relating to the family to the termination file. It is possible that there was a legitimate security purpose at the start of the review. However, this purpose does not constitute justification of the same weight for seeing and sharing all personal content. First it should be asked whether the investigation could have been carried out with date and recipient records connected with the incident. 4 5
On the employee's side, merely saying that the messages were private is not enough. Which policy was communicated on the date of the incident, which date range the review covered, why the family messages were taken into the file and who accessed them must be determined. The employer, for its part, may explain the seriousness of the leak, why a narrow review was insufficient and what measures it took to protect unrelated data. The court's answer to these claims of both sides matters in constitutional review.
Here three separate outcomes are examined: the lawfulness of the monitoring, the value of the records obtained from the monitoring for the termination and the subsequent use of the personal data. A decision on one does not automatically resolve the others. That the employee violated a workplace rule does not make all of the employer's access methods lawful; nor does a deficiency in the monitoring in every case make conduct proved by other evidence be treated as never having occurred. The concrete request should be framed with these distinctions in mind.
If deletion or correction of the records is being considered, the need for preservation in ongoing proceedings should also be assessed. Preserving a record necessary for the exercise of a right is not the same as indefinite archiving. If the purpose of the application is to stop unlawful dissemination, it may be clearer to ask for a limited solution, specifying the relevant data group and access authorizations. A request for the protection of personal data should not turn into a proposal for the indiscriminate destruction of all records in a way that would make it impossible to prove the dispute. 2
Representation, form of application and costs
The person making the application must show which account or conversation belongs to him or her and how he or she was affected by the interference. A general objection to the employer's entire system and a claim of access to one's own correspondence must be separated. In internal complaints, applications to the data controller, and proceedings before the prosecutor's office and the labor court, the results sought are written differently from one another. For a lawyer applying on behalf of an employee, the power of attorney, the applicant's identity and the connection with the examined account must be properly established.
An AYM individual application is prepared with the application form and the necessary attachments. The final decision, the learning record and the results of the ordinary applications should be presented in an orderly way; general references to long petitions in the attachments should not be made in place of the form. The application is subject to a fee; those without the means to pay may request legal aid if the conditions are met. Fees and expenses and the attorney's fee agreement are separate items. The amount on the date of application and the payment document should be checked; the previous year's tariff should not be used. Paying a fee or requesting legal aid does not, on its own, cure an incomplete form, an application out of time or an unexhausted route. 3
Conclusion
Protecting freedom of communication depends on correctly determining the source and scope of the access. Public security or the employer's legitimate interest is important; but it does not remove review of authority, necessity and proportionality. An effective application is one that is directed in time to the correct authority and explains every claim with concrete records. General information is not a substitute for a legal assessment made according to the particular features of the case.
Frequently Asked Questions
Does the fact that corporate e-mail belongs to the company allow all messages to be read?
No. A legitimate aim, clear notice, the necessary scope and data protection safeguards are assessed together. A review of content is a more intensive interference than merely checking the flow of communication.
Is a general consent text signed by the employee sufficient?
Not in every case. Whether consent is based on free will, is specific and satisfies the privacy notice obligation is examined separately. General consent does not create a power of unlimited or continuous monitoring.
Is reading the messages on a spouse's phone automatically lawful?
No. Marriage does not remove the confidentiality of communication. The method of access, consent, purpose and manner of use must be assessed in the concrete case.
Is applying only to KVKK enough for a violation of communication?
Not always. Claims for an offense, a dismissal, compensation or the prevention of the spread of content may require different authorities. The conditions and periods of each route are tracked separately.
If an e-mail review was unlawful, is reinstatement certain?
No. The conditions of job security, the ground for termination, the lawfulness of the evidence and the periods are assessed together. An AYM violation decision also does not directly decide all labor claims.
Are old messages inside a phone and live interception the same operation?
No. A digital device review, seizure and telecommunications monitoring may be subject to different legal conditions. The operation carried out must be described correctly.
Can all letters in a penal institution be blocked?
There is no general and unlimited power to block. The statutory basis, the concrete content, institutional security and the special safeguards for correspondence must be taken into account.
Is the AYM application period the same as the KVKK complaint period?
No. For the AYM, learning of the final decision and exhaustion of ordinary remedies is the basis; for KVKK, the application to the data controller and the reply process. Even periods with the same number of days do not have the same starting point.
Sources and legal bases
1. Constitution of the Republic of Türkiye (Türkiye Cumhuriyeti Anayasası), Articles 13, 20, 22, 36 and 148. Official text.
2. Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu), in particular Articles 4–6, 10–14 and 28. Official text.
3. Law No. 6216, Articles 45–50. Official text.
4. AYM, E.Ü. [GC], Application No. 2016/13010, September 17, 2020, in particular §§ 68–79. Official decision.
5. AYM, Celal Oraj Altunörgü, Application No. 2018/31036, January 12, 2021. Official decision.
6. Law No. 5271, Code of Criminal Procedure (Ceza Muhakemesi Kanunu), in particular Articles 134–138 and 267–269. Official text.
7. AYM, Yasemin Çongar and Others [GC], Application No. 2013/7054, January 6, 2015, assessment of legality and judgment. Official decision.
8. Personal Data Protection Board (Kişisel Verileri Koruma Kurulu), principle decision of September 16, 2026, No. 2026/2035, Official Gazette October 8, 2026, No. 33394. Full text published by the institution.
9. Law No. 5275 on the Execution of Sentences and Security Measures (Ceza ve Güvenlik Tedbirlerinin İnfazı Hakkında Kanun), in particular Articles 66 and 68. Official text.
10. Law No. 5237, Turkish Penal Code (Türk Ceza Kanunu), in particular Articles 73, 132–139. Official text.
11. Law No. 4857, Labor Law (İş Kanunu), in particular Articles 18–21. Official text.
12. AYM, "Individual Applications Began to Be Accepted Through the UYAP Attorney Portal" (Bireysel Başvurular UYAP Avukat Portalı Üzerinden Alınmaya Başlandı), October 1, 2025. Official announcement.
13. Law No. 4675 on Enforcement Judgeships (İnfaz Hâkimliği Kanunu), Articles 5–6. Official text.