KVKK email retention period and corporate document retention: key principles

What does KVKK require for corporate email and files?

Article 4 of Law No. 6698 on the Protection of Personal Data requires that personal data be processed lawfully and fairly, for specific and legitimate purposes, in a manner connected to and limited and proportionate to that purpose, and be kept only for as long as the relevant legislation requires or the purpose of processing demands. Article 12 places an obligation on the data controller to take the necessary technical and administrative measures to prevent unlawful access to the data and to ensure its protection.

Corporate email boxes and shared folders are, in most companies, where the most personal data accumulates: customer correspondence, employee documents, contracts, invoices and ID copies. In practice, KVKK compliance in these areas means giving a clear answer to three questions: Who can access this data? How long is it kept? How is it deleted once that period ends?

How is the retention period set for email and files?

The retention period is set based on the type of data and the purpose of processing. Tax, commercial and labor regulations set different retention periods for different document types; an invoice, an employment contract and a customer request don't share the same basis or length of retention.

That's why the period for each data category, along with its legal basis, must be written down in a personal data retention and disposal policy. The Regulation on the Deletion, Destruction or Anonymization of Personal Data requires data controllers obligated to prepare this policy to carry out their deletion operations periodically.

In email and file systems, the practical equivalent is that deleted content waits in a recycle bin for a set period before being permanently cleared, and that period should be configurable by the organization. Who performed the deletion and when must also be on record.

How is access restricted for files containing personal data?

Only people who need it for their work should have access to mailboxes and folders containing personal data. In a mailbox shared through a common password, who accessed it can't be told apart; cutting off a departing employee's access would require changing everyone's password.

A sounder approach is to grant access by person or by department and separate permissions by task: able to read but not delete, able to upload but not edit someone else's file, and so on. HR documents are open only to the HR department, customer contracts only to the relevant team. This applies the principle of least privilege, and the access list naturally becomes a record in itself.

Why does record-keeping matter?

In the event of a suspected data breach, or when a data subject makes an application under Article 11 of KVKK, the organization needs to be able to answer "who accessed what, and when." Permission changes, mailbox and folder access, setting changes and deletions must be logged with date, time and user information.

Where data is stored matters too. Keeping organizations' data separate from one another, protecting it against unauthorized access, and knowing whether it's transferred abroad are the foundation of technical safeguards.

The records themselves must be protected as well: logs showing who accessed what should only be viewable by authorized people, and their own retention period should be set out in policy. Actions taken by automated systems, such as automatic deletion or quarantine, must be written in a way that distinguishes them from actions taken by a person, so that whose decision an action was is never in question.

What should be done if there's a data breach?

Paragraph 5 of Article 12 of KVKK requires the data controller to notify the data subject and the Board as soon as possible if processed personal data is obtained unlawfully by others. The Personal Data Protection Board has ruled that this period is 72 hours from the moment the data controller becomes aware of the breach.

An email mailbox being compromised, or a folder containing personal data being shared with the wrong people, can fall into this category. That's why being able to quickly pull from the records which data was accessed, by whom, and when, is a precondition for making a timely and accurate notification in the event of a suspected breach.

How is a retention and disposal policy prepared?

1. List the categories of personal data processed by the organization: customer, employee, supplier, applicant, and so on.
2. Write down which system each category sits in: email boxes, file areas, accounting software.
3. Set the retention period for each category and its legal basis.
4. Write down the method to apply once the period ends: deletion, destruction or anonymization.
5. Set the periodic deletion schedule and the people responsible for it.
6. Review the policy at regular intervals.

The details of the policy vary from organization to organization; we recommend working with a legal advisor while preparing it.

What rules should be communicated to employees?

• What corporate email and file areas may be used for.
• Not transferring documents containing personal data to personal devices or personal accounts.
• Sending attachments containing personal data only to the recipients who need them.
• Deleting documents that are no longer needed, in line with policy.

Communicating these rules through a written policy both builds awareness and strengthens the organization's accountability.

These rules shouldn't just be explained once at onboarding and left there; they should be refreshed with a short reminder at least once a year, and employees should be notified separately whenever the policy changes.

How does the DBLinx family support these principles?

In DBLinx products, each organization's data sits in its own separate database for each product. Access is granted by person or by department: SmartMail has nine separate permissions per mailbox, SmartFiles has eight separate permissions per storage area. When a person leaves a department, their SmartMail access is automatically revoked; when a person leaves the organization, their access across all products is removed in a single action.

Deleted emails and files wait in the recycle bin for a period the organization sets, then are permanently cleared. Actions such as opening a mailbox, granting access, changing settings and adding a sender rule are logged with the actor, the time and the IP address. Details: DBLinx ecosystem and SmartFiles field-based permissions.

Frequently asked questions

Does correspondence in corporate email fall under KVKK?

Correspondence in a corporate mailbox may contain personal data. The rules of use and oversight for corporate email should be communicated to employees through a clear policy; consult your legal advisor for details.

How long should we keep emails?

There is no single retention period; tax, commercial and labor regulations set different retention periods for different documents. Set this out in your retention and disposal policy according to your data types.

What happens to the data in a departing employee's mailbox?

Access to the mailbox should be revoked immediately; who inherits the business correspondence in it, and for how long it will be kept, should be set out in policy.

What happens if the data subject asks for their data to be deleted?

Under Article 13 of KVKK, the data controller must finalize the request as soon as possible and no later than thirty days, depending on the nature of the request. This requires being able to quickly find which mailboxes and folders a person's data sits in.

Does using a cloud service violate KVKK?

Using the cloud isn't inherently a violation. What needs to be assessed is where and how the data is stored, whether it's transferred abroad, and whether the necessary safeguards are in place.