Employee Computer Monitoring: The Employer's Legal Limits

One of the questions employers ask most often is: "Can I monitor my employee's company computer?" The short answer: yes, under certain conditions. But skipping those conditions turns a productivity tool into a legal risk.

This article is for general information and does not replace legal advice. Always consult a legal advisor before any concrete implementation.

The legal framework: what does KVKK say?

Law No. 6698 on the Protection of Personal Data (KVKK) accepts that an employee's activity on workplace devices can also be personal data. Monitoring must therefore comply with the fundamental principles of the law.

• Lawfulness and good faith: monitoring must not be secret or sneaky, but based on a known and legitimate footing.
• A specific and legitimate purpose: not "just in case", but a concrete purpose such as data security, productivity or a legal obligation must be defined.
• Proportionality: no more data than necessary for the purpose should be collected (e.g. reading the content of private messages is generally disproportionate).
• Storage limitation: data should not be kept longer than needed for the purpose.

Notice and consent: the two most critical steps

The common emphasis of Constitutional Court and Court of Cassation case law is clear: the employee must be informed in advance and explicitly about the monitoring. Records obtained through undisclosed monitoring may be deemed unlawful and may lose their value as evidence in a lawsuit.

• Privacy notice (KVKK art. 10): which data, for what purpose, for how long and by what method it is processed must be communicated in writing.
• Workplace policy: the scope of monitoring should be documented in an annex to the employment contract or in an IT usage policy.
• Explicit consent (where required): although legitimate interest is sufficient in some cases, written explicit consent is the safest route for comprehensive monitoring.
• Data security (KVKK art. 12): access to monitoring data should be restricted to authorized persons and the data should be stored encrypted.
• Company devices only: monitoring an employee's personal device is subject to much narrower conditions; as a rule, stay limited to company-owned devices.

What does proportionate monitoring look like in practice?

The principle of proportionality means "seeing the usage pattern" rather than "reading the content". For example, seeing how much time is spent in which application and how much time is spent on non-work sites is enough for most purposes; accessing the content of private messages, on the other hand, is generally disproportionate.

• Prefer reporting focused on duration and category, not content.
• Monitoring limited to working hours is more proportionate than 24/7 monitoring.
• Restrict access to authorized persons; keep the data encrypted.

Using Spektio on a lawful footing

On company devices, Spektio reports app/web/game times and screen time by category; it provides usage visibility, not content disclosure. This aligns with a monitoring model that respects the principle of proportionality.

Setting up responsibility correctly is up to you: use Spektio only on company-owned devices, informing employees in advance and documenting it in your internal policy. Define authorized access to the data and reasonable retention periods.