A detailed legal guide to whistleblowing policies and internal reporting mechanisms in Turkey, covering HR duties, anti-retaliation, internal investigations, data protection, workplace safety reporting, disciplinary action, and employer compliance.
Whistleblowing is often described as an ethics topic, but in employment law it is much more than that. In Turkey, internal reporting is tied to the employer’s duty to maintain a lawful and orderly workplace, protect employee personality rights, respond to harassment and compliance breaches, process complaint data lawfully, and avoid retaliatory treatment. For that reason, whistleblowing policies and internal reporting mechanisms should be treated as a core HR compliance subject rather than a voluntary corporate-governance add-on. In private-sector employment practice, the main legal framework is built through a combination of Labour Act No. 4857, the Turkish Code of Obligations No. 6098, Occupational Health and Safety Law No. 6331, the Personal Data Protection Law No. 6698, and the anti-discrimination structure under Law No. 6701. (natlex.ilo.org)
The practical reason this matters is simple. Employees report many different things through internal channels: harassment, discrimination, payroll irregularities, misuse of authority, safety risks, retaliation, disclosure of confidential information, and serious misconduct by managers or colleagues. Once the employer is informed, the issue is no longer only interpersonal. It becomes a legal-risk event. A company that has no clear internal reporting mechanism may fail to detect problems early, mishandle evidence, expose sensitive personal data, or react in a way that later looks retaliatory or discriminatory. Turkish law does not force every employer into one single whistleblowing template, but it does impose duties that make structured internal reporting systems highly important.
Why whistleblowing matters legally in Turkey
The clearest general foundation is Article 417 of the Turkish Code of Obligations. That article requires the employer to protect and respect the employee’s personality in the employment relationship, maintain workplace order in line with honesty, and, in particular, take necessary measures so that employees are not subjected to psychological or sexual harassment and so that those who have already been subjected to such conduct do not suffer further harm. The same article links violations of these duties to contractual liability for damage resulting from death, bodily harm, or violation of personality rights. In practice, an internal reporting mechanism is one of the main tools an employer uses to discover whether such risks exist and to respond before they grow into deeper legal liability.
Labour Act No. 4857 adds more specific consequences. Article 24 gives the employee a right to terminate for just cause if the employer sexually harasses the employee, and also if another employee or a third person in the workplace sexually harasses the employee and the employer fails to take adequate measures after being informed. Article 25 gives the employer a right of summary termination if an employee sexually harasses another employee, commits dishonest acts, breaches trust, discloses trade secrets, repeatedly absents himself without permission, refuses duties after warning, or seriously endangers safety. These provisions show why reporting channels matter. They are often the route through which the employer first learns facts that may require immediate protective measures or disciplinary action. (natlex.ilo.org)
Turkish labour law also protects employees from retaliation in important ways. Article 18 states that, in job-security cases, the employer must rely on a valid reason for termination, and it expressly says that filing a complaint or participating in proceedings against an employer involving alleged legal violations, or applying to competent administrative or judicial authorities, does not constitute a valid reason for dismissal. The same article also excludes union activity and discrimination-related grounds such as sex, pregnancy, religion, political opinion, and family responsibilities from valid-reason dismissal. This makes whistleblowing legally sensitive because a poorly timed or poorly justified dismissal after an internal report may later look like retaliation rather than neutral management. (natlex.ilo.org)
The equality framework strengthens this even further. Law No. 6701 states that an employer or a person authorized by the employer may not discriminate at any stage of employment, including working conditions and termination. The Human Rights and Equality Institution’s Anti-Discrimination and Equality Guide also explains that unfavorable treatment of persons who initiate or participate in administrative or judicial proceedings to secure equal treatment or prevent discrimination is a form of victimization. In HR terms, that means an employee who reports discrimination, supports another employee’s complaint, or gives evidence in an internal inquiry should not then face hidden punishment through exclusion, downgraded evaluations, or targeted termination.
Occupational health and safety law creates another important reporting framework. Article 13 of Law No. 6331 gives workers exposed to serious and imminent danger the right to apply to the committee or, where no committee exists, to the employer, requesting identification of the hazard and emergency intervention. If the request is upheld, the worker may abstain from work while preserving pay and rights; in cases of serious, imminent, and unavoidable danger, workers may leave the danger area directly. Article 18 of the same law requires consultation with workers or their representatives on safety and health at work, including the introduction of new technology and the consequences of equipment choices, working conditions, and the working environment. In practice, this means internal reporting is not only an ethics or fraud issue. It is also an OHS participation and escalation issue.
Internal reporting in Turkey is governed through several legal duties at once
For HR teams, the first important insight is that Turkish law does not treat internal reporting through only one branch of law. A complaint may trigger the employer’s duty to protect personality rights under Article 417, a safety-response duty under Law No. 6331, a non-retaliation issue under Labour Act Article 18, a discrimination issue under Law No. 6701, a confidentiality obligation under Labour Act Article 75, and a data-processing issue under KVKK all at the same time. A weak whistleblowing mechanism therefore creates multiple kinds of legal exposure simultaneously.
Article 75 of the Labour Act is especially useful here. It requires the employer to keep a personnel file for each employee and to maintain the documents and records required by labour legislation and other laws, but it also requires the employer to use employee information in accordance with honesty and law and not to disclose information the employee has a justified interest in keeping secret. Internal reports and investigation records often end up in or alongside personnel files. That means HR must balance documentation and confidentiality together. A company that keeps no record of complaints may fail to prove compliance later, while a company that circulates complaint details widely may violate confidentiality duties. (natlex.ilo.org)
KVKK makes this balance even more demanding. Article 4 requires personal data to be processed lawfully and fairly, for specified and legitimate purposes, in a relevant, limited, and proportionate manner. Article 5 allows processing without explicit consent in several situations highly relevant to internal reporting, including where processing is directly related to the establishment or performance of a contract, necessary for compliance with a legal obligation, necessary for the establishment, exercise, or protection of a right, or necessary for the controller’s legitimate interests so long as the data subject’s fundamental rights and freedoms are not violated. A whistleblowing file will often rely on one or more of those legal grounds rather than on employee consent. (KVKK)
Where reports involve health information, criminal-conviction data, union membership, biometric records, or similar sensitive categories, Article 6 becomes central. It defines special categories of personal data and permits processing only under specific conditions, including where it is explicitly provided by law, necessary for the protection of a right, or necessary for legal obligations in employment, occupational health and safety, and social security. This is highly relevant for harassment complaints, workplace-violence reports, safety incidents, and discrimination investigations. HR should therefore assume that at least some whistleblowing files will involve heightened privacy sensitivity and should be handled through restricted access and need-based processing. (KVKK)
KVKK also requires transparency and response mechanisms. Article 10 obliges the data controller to inform data subjects of the controller’s identity, processing purposes, transfer recipients, legal basis, and Article 11 rights at the time personal data are obtained. Article 11 gives employees rights including learning whether their data are processed, understanding the purpose of processing, knowing recipients, requesting rectification, requesting erasure or destruction where lawful, objecting to adverse results produced solely by automated systems, and claiming compensation for unlawful processing. Article 12 requires technical and organizational security measures, and Article 13 requires the controller to respond to requests within the shortest time and no later than 30 days. A lawful whistleblowing mechanism therefore cannot be designed as a secrecy-only tool. It must also fit inside the organization’s privacy-notice and data-governance structure. (KVKK)
What a lawful whistleblowing policy should contain
A strong internal reporting policy in Turkey should first define its scope clearly. It should explain what kinds of issues the employer expects to be reported: harassment, discrimination, retaliation, safety hazards, serious misconduct, abuse of authority, breaches of workplace rules, and other legal or ethical concerns identified by the employer. The legal reason for clarity is that different categories of report trigger different duties. A harassment report may require immediate protection under Article 417 and Articles 24–25 of the Labour Act, while a safety report may engage Law No. 6331 rights and consultation duties. A vague policy makes it harder for employees to know where to report and harder for HR to classify cases correctly.
Second, the policy should provide more than one reporting route. This is a practical requirement derived from the legal structure. If the complaint concerns the direct manager, reporting only to the direct manager is not a meaningful mechanism. If the issue concerns safety, the OHS committee or employer route recognized by Article 13 may matter. If the issue concerns discrimination or harassment, HR or a higher compliance function may need to receive it directly. A legally sound system therefore usually includes at least a managerial route, an HR/compliance route, and a path for safety-sensitive reports consistent with OHS law.
Third, the policy should contain a clear non-retaliation statement. This is not just a cultural preference. It mirrors the logic of Labour Act Article 18 and the TİHEK anti-victimization framework. The policy should make clear that no employee will be dismissed, demoted, isolated, or otherwise disadvantaged for making a good-faith report, participating in an investigation, or supporting another employee’s complaint. At the same time, the policy can reserve the right to address intentionally false or malicious allegations through the ordinary disciplinary framework. That balance is important because Turkish law protects reporting and participation, but it does not require employers to tolerate deliberate abuse of internal systems. (natlex.ilo.org)
Fourth, the policy should explain confidentiality in a legally accurate way. HR should never promise absolute secrecy that cannot be maintained in a real investigation. Instead, the policy should state that reports will be handled on a need-to-know basis, that access will be restricted to those who must review the matter, and that information will be processed in line with labour-law confidentiality and KVKK rules. This approach is more defensible than promising that identities will never be revealed, because some cases will require witness questioning, disciplinary defense, or external reporting. (natlex.ilo.org)
Fifth, the policy should explain what happens after a report is made. Employees should know that the employer may acknowledge receipt, conduct an initial triage, decide whether interim protective measures are needed, investigate proportionately, and determine whether corrective or disciplinary action is required. This matters because Turkish law often penalizes inaction after notice rather than only the original wrongdoing. For example, Article 24 gives the employee a just-cause exit right where sexual harassment by another employee or a third person is reported and the employer fails to take adequate measures. The policy should therefore show that reporting triggers process, not silence. (natlex.ilo.org)
Investigations and disciplinary outcomes must stay within legal boundaries
An internal reporting mechanism is only as lawful as the investigations and sanctions it produces. Once HR receives a report, it must classify the possible outcome correctly. Some matters may call for coaching, training, or no action. Others may justify a warning, a wage-deduction penalty if the contractual basis exists, a change proposal under Article 22, a conduct-based dismissal under Articles 18 and 19, or immediate dismissal under Article 25 if the facts truly fit the just-cause categories. Turkish law does not permit HR to collapse all reports into “company discretion.” (natlex.ilo.org)
Where the employer is considering dismissal based on conduct, Article 19 is decisive. The employer must issue written notice stating the reason clearly and precisely, and an employee under an open-ended contract may not be dismissed for conduct or performance reasons without first being given an opportunity to defend against the allegations. That means whistleblowing investigations should not jump directly from accusation to termination unless the employer is truly proceeding under the narrower Article 25 just-cause route. A fair defense process is a legal safeguard, not merely a courtesy. (natlex.ilo.org)
Where the employer believes Article 25 applies, it should still move carefully. The provision covers a narrower group of serious cases such as sexual harassment of another employee, serious dishonesty, repeated unauthorized absence, refusal of duties after warning, or grossly dangerous conduct. Article 26 then adds a strict timing rule: the just-cause right based on immoral or malicious conduct must generally be exercised within six working days of learning of the act and, in any event, within one year of its occurrence unless the employee obtained material benefit. This is crucial in whistleblowing cases because delayed action can weaken the employer’s position even where the underlying allegation is serious. (natlex.ilo.org)
Disciplinary changes that stop short of dismissal can also trigger legal issues. If HR responds to a report by reassigning the accused worker, changing duties, relocating a team member, or downgrading a role, Article 22 may apply if the measure amounts to a substantial change in working conditions. In that case, the employee’s written acceptance within six working days becomes central. A whistleblowing policy should therefore not assume that every corrective action is legally simple merely because it falls short of termination. (natlex.ilo.org)
Internal reporting is especially important for safety complaints
Workplace safety is one of the areas where internal reporting mechanisms have a direct statutory function. Article 13 of Law No. 6331 gives workers a formal route to apply to the OHS committee or employer when they face serious and imminent danger, and it protects their right to abstain from work with pay if the request is upheld. Article 18 requires the employer to consult workers or their representatives on safety and health matters, including the introduction of new technology and the consequences of work conditions and equipment choices. In practical terms, a modern whistleblowing or ethics line in Turkey should be able to receive and route safety reports quickly, rather than treating them as secondary operational complaints.
This is particularly relevant in restructurings, technology rollouts, production-line changes, and hybrid or remote work setups. Employees may be the first people to see unsafe shortcuts, defective equipment, or risk consequences that management did not foresee. A reporting mechanism that is focused only on financial misconduct misses part of the employer’s legal duty under the OHS law. HR should therefore coordinate whistleblowing channels with OHS structures rather than keeping them entirely separate.
Retaliation is often the real litigation risk
In many whistleblowing disputes, the underlying misconduct is not what produces the lawsuit. The lawsuit comes from retaliation. Turkish law is very sensitive to that possibility. Labour Act Article 18 says that filing complaints or participating in proceedings involving alleged violations is not a valid ground for dismissal in covered job-security cases. The TİHEK framework also recognizes unfavorable treatment against persons who initiate or participate in proceedings to secure equal treatment or prevent discrimination as victimization. For HR, the most important discipline after a report is therefore often not the investigation itself, but the months that follow it. (natlex.ilo.org)
That means managers should be warned not to isolate the reporting employee, cut them out of meetings, reduce assignments without reason, label them “disloyal,” or build a rushed performance case that begins only after the report. Those patterns are exactly what later make a retaliation argument persuasive. A compliant whistleblowing system should therefore include monitoring after the report, not only intake before the investigation. (natlex.ilo.org)
How HR should implement the system
A practical HR model in Turkey usually begins with a written whistleblowing or internal reporting policy, a privacy notice tailored to investigations, defined access rules, and a case-management process that separates intake, triage, investigation, and outcome. The system should identify which complaints go to HR, which go to legal/compliance, which go to OHS structures, and when senior management or the board should be informed. Complaint handlers should be trained not only in interviewing and documentation, but also in the legal boundaries of retaliation, confidentiality, defense rights, and data minimization. (KVKK)
HR should also decide in advance how long records will be kept, who may see them, and when data must be restricted, erased, or updated under KVKK. Investigation files often outlast the immediate incident and may later be used in disciplinary proceedings, dismissal disputes, discrimination complaints, or authority inspections. Poor retention or uncontrolled access can therefore convert a well-intentioned reporting system into a privacy problem. (KVKK)
The strongest employers also align whistleblowing with workplace culture. That does not mean promising employees that every report will lead to dismissal. It means explaining that reports will be taken seriously, reviewed proportionately, and handled through lawful process. In Turkish law, credibility matters. If employees believe reporting is pointless or dangerous, they may go directly to external authorities, resign for just cause, or later claim that the employer failed to maintain an honest and safe workplace.
Conclusion
In Turkey, whistleblowing policies and internal reporting mechanisms are best understood as a compliance system built from several legal duties at once. Article 417 of the Turkish Code of Obligations requires the employer to protect employee personality rights and prevent harassment. Labour Act No. 4857 protects employees from retaliatory dismissal in key situations, gives employees a just-cause exit right if reported harassment is not addressed, regulates employer-side just-cause dismissal for serious misconduct, requires written and precise termination reasons, preserves confidentiality in personnel files, and restricts certain sanctions such as wage deductions. Law No. 6331 gives workers formal channels to report serious danger and requires worker consultation on safety-related change. KVKK governs the processing, security, transparency, and employee-rights aspects of complaint data. Law No. 6701 reinforces the ban on discrimination and recognizes victimization for participation in equality-related proceedings.
For HR teams, the safest conclusion is clear. A whistleblowing mechanism should not be a symbolic hotline. It should be a written, confidential, non-retaliatory, data-compliant, investigation-ready process that can receive reports, classify them correctly, protect the reporting employee, preserve the defense rights of the accused, and support legally sound outcomes. When that system exists, internal reporting becomes one of the employer’s best tools for preventing harassment, safety failures, and expensive retaliation disputes before they escalate.
Yanıt yok