Former Employee Deletes Company Data Before Resigning in Turkey: Criminal Liability and Evidence (2026 Updated Guide)

A former employee deletes company files, emails, customer records or business data before leaving a Turkish company. Learn about criminal liability, digital evidence, forensic examination, compensation and urgent legal remedies.

When an employee deletes company data shortly before resigning or immediately before leaving employment in Turkey, the incident can develop into much more than an employment dispute. Depending on what was deleted, how the employee accessed the system, whether the data belonged to the company, whether backups exist, whether access authorization was exceeded and whether the deletion caused damage, the conduct may raise criminal-law, civil, employment and data-protection issues.

For foreign-owned companies operating in Turkey, the first hours after discovering the deletion can be particularly important. The company should preserve logs, suspend unnecessary access, secure devices and backups, identify affected systems and avoid actions that could destroy digital evidence. Lawyer Fırat Fesih Kaya emphasizes that a technically sound evidence-preservation strategy can be as important as the criminal complaint itself in disputes involving deleted corporate data.

Is Deleting Company Data a Crime in Turkey?

Potentially. Not every deletion of a workplace file automatically constitutes a criminal offense. Criminal liability depends on the circumstances.

However, deliberately deleting, destroying, altering, rendering inaccessible or interfering with data contained in an information system may potentially fall within Turkish criminal-law provisions concerning information systems where the statutory elements are satisfied.

Additional offenses may become relevant depending on whether the employee also copied confidential information, obtained unauthorized access, disclosed personal data, misused passwords or committed another act against the company.

The Employee’s Previous Access Authorization Does Not Automatically Resolve the Case

A common defense is: “I was authorized to access those files because I was an employee.”

Access authorization and authority to destroy data are different questions.

An employee may legitimately have access to a customer database, accounting folder or project-management platform for work purposes without having authority to permanently delete the company’s records before departure.

The scope and purpose of the employee’s authorization therefore require careful examination.

What Types of Deleted Data Can Create Serious Legal Problems?

The dispute may involve customer lists, contracts, accounting records, invoices, project files, engineering documents, source code, internal correspondence, databases, CRM records, supplier information, pricing files, photographs, security records, cloud documents or business email.

The commercial significance of the deleted material can affect both the investigation and the company’s potential damages.

Permanent Deletion Is Not Always Necessary

A file does not necessarily need to disappear forever before the incident becomes legally relevant.

Changing passwords, encrypting information, removing administrator access, deleting cloud folders or otherwise making company data inaccessible may also require investigation.

The technical effect of the employee’s conduct should therefore be established precisely.

First Priority: Preserve Digital Evidence

The company should avoid immediately formatting computers, reinstalling operating systems or allowing multiple employees to investigate the device informally.

Such actions may overwrite important evidence.

Preservation should begin before remediation wherever commercially and technically possible.

Preserve System Logs

Logs may reveal when the employee logged in, which account was used, which files were accessed, whether folders were deleted and whether unusual activity occurred shortly before resignation.

Relevant evidence may exist in servers, cloud platforms, email systems, VPN systems, endpoint-security products and access-management systems.

Preserve the Employee’s Company Computer

If the computer belongs to the employer, its evidentiary condition should be protected.

The company should document when the device was recovered, who possessed it and what actions were subsequently performed on it.

This helps preserve the integrity of later forensic findings.

Do Not Search the Computer Carelessly

An internal IT employee repeatedly opening files and attempting recovery can alter metadata.

Where criminal proceedings are contemplated, forensic preservation should be considered before extensive manual examination.

Forensic Images Can Become Important

Digital-forensic specialists may create an appropriate forensic copy of a device so that examination can occur without unnecessarily changing the original evidence.

Hash values and other integrity mechanisms may also become important in demonstrating that the examined data correspond to the preserved evidence.

Deleted Files May Be Recoverable

Deletion does not always mean that information has disappeared technically.

Depending on the device, storage architecture and subsequent use, forensic examination may identify deleted files, metadata or evidence of deletion.

Cloud services may also preserve versions, activity histories or recovery information.

Cloud Logs Can Be Crucial

Modern companies frequently use cloud email, document storage, CRM and collaboration systems.

These platforms may contain login histories, deletion events, file versions, IP information and administrative records capable of reconstructing what happened.

Preserve Backups Before Restoring Everything

The business may need to restore deleted data quickly to continue operations. That is understandable.

Before restoration, however, preserve evidence showing the condition of the system when the incident was discovered.

Otherwise, the company may restore its business but weaken its ability to prove the original interference.

Identify the Exact User Account

A deletion performed through an employee’s username does not necessarily prove personally who operated the account.

Investigators may need to consider passwords, multi-factor authentication, IP addresses, device information, office-access records and other evidence.

IP Address Evidence Is Not Always Enough

An IP address can support a digital investigation, but it should not automatically be treated as conclusive identification of an individual.

Shared networks, VPNs, remote access and other technical circumstances may need to be examined.

CCTV Evidence May Help

Where relevant and lawfully obtained, workplace security footage may assist in establishing whether the employee was physically present when a company computer was used.

Retention periods can be short, so potentially relevant footage should be preserved promptly.

Access-Control Records Can Support the Timeline

Building-entry systems, office-access logs and other legitimate corporate records may help reconstruct when the employee entered or left the workplace.

These records should be evaluated together with digital evidence rather than in isolation.

Email Evidence Can Establish Intent

Correspondence before resignation may show disagreements concerning access, threats to delete information, instructions to transfer files or discussions about returning company property.

However, context matters. A single message should not automatically be interpreted as proof of criminal intent.

WhatsApp and Other Messages May Become Evidence

Messages may be relevant where they demonstrate instructions, admissions, coordination or motive.

The authenticity and completeness of screenshots should be considered carefully. Original devices and complete conversations can be more valuable than isolated images.

Was the Deletion Intentional or Accidental?

Intent can become a central issue.

A former employee may claim that files were deleted during ordinary cleanup, synchronization, account migration or transfer of work to another employee.

The company should therefore establish why the deletion appears deliberate.

Timing Can Be Important

Mass deletion shortly before resignation, particularly after copying information or changing access credentials, may present a different factual picture from routine deletion of temporary files months earlier.

Construct a detailed timeline.

Was the Employee Told to Delete Personal Files?

Some companies instruct departing employees to remove personal materials from corporate devices.

If such an instruction existed, the investigation should distinguish legitimate removal of personal content from deletion of corporate information.

Company Policies Matter

Information-security policies, acceptable-use rules, confidentiality agreements and exit procedures may help establish the scope of authorized conduct.

The company should preserve the version of the policies that applied while the employee was working.

Employment Contract Provisions Should Be Reviewed

Check provisions concerning confidentiality, intellectual property, company property, information systems, passwords, return of devices and post-employment obligations.

These provisions can also be important in parallel compensation proceedings.

What If the Employee Copied the Data Before Deleting It?

This can create a more complex case.

The company should determine whether information was transferred to a USB device, personal email account, private cloud account or another external system before deletion.

Data exfiltration and deletion should be investigated separately.

USB Activity May Be Relevant

Forensic analysis may reveal that removable storage devices were connected shortly before the employee left.

However, the presence of a USB device alone does not prove that confidential files were copied. Additional evidence may be necessary.

Personal Email Transfers Should Be Investigated

Company email records may show files sent to a private address.

The nature of the files, employee’s authorization and legitimate business explanation should all be examined.

Trade Secrets Can Create Additional Exposure

If the employee takes commercially valuable confidential information and provides it to a competitor or uses it after resignation, additional commercial and potentially criminal issues may arise depending on the facts.

The company should identify precisely what information it considers confidential and how that confidentiality was protected.

Personal Data Can Create a Separate Problem

Customer or employee databases may contain personal data.

Unauthorized copying, disclosure or misuse can therefore create issues beyond damage to the company’s information system.

The company should assess its separate data-protection obligations following the incident.

Criminal Complaint Should Be Evidence-Based

A company should avoid filing an exaggerated complaint merely because an employee resigned under difficult circumstances.

The complaint should explain what data existed, who had access, what changed, when the deletion occurred, how it was discovered and what technical evidence supports the allegation.

Digital Evidence Should Be Submitted Properly

Providing only printed screenshots may leave significant evidentiary questions unanswered.

Where appropriate, original digital records, forensic findings, system logs and information identifying their source should be preserved.

Prosecutors May Seek Digital Examination

Depending on the allegations and available evidence, criminal investigative measures may involve examination of relevant computers, storage devices or other digital materials under the applicable criminal-procedure rules.

The necessity and proportionality of each measure depend on the case.

The Former Employee Also Has Defense Rights

Being identified by the company does not establish guilt.

The former employee may challenge attribution, authenticity, forensic methodology, scope of authorization, intent and the company’s interpretation of the deleted information.

Criminal liability must be established through lawful and reliable evidence.

Can Secret Monitoring Be Used Against the Employee?

Companies should be cautious.

Workplace monitoring, email supervision and employee-data processing raise privacy and data-protection questions. Evidence-gathering methods should therefore be evaluated for lawfulness rather than assuming that every technically obtainable record can automatically be used without restriction.

What If the Employee Used Their Own Laptop?

Bring-your-own-device arrangements make the situation more complicated.

The employer’s ownership of business data does not automatically give it unrestricted authority to search an employee’s personal computer or private accounts.

Appropriate legal procedures may be necessary.

Can the Company Demand Return of the Data?

Where the former employee possesses company information, the employer may need to consider civil, contractual and other legal remedies in addition to the criminal investigation.

The immediate objective may include preventing further use or disclosure.

Injunctive Relief May Be Important

If confidential information is being used or disclosed after resignation, waiting for completion of a criminal investigation may not adequately protect the business.

Depending on the circumstances, urgent civil or commercial measures may need to be evaluated separately.

Can the Company Claim Compensation?

Potentially.

If unlawful deletion causes measurable financial loss, the company may evaluate compensation claims against the responsible person.

The company must still prove the damage and causal connection.

What Losses Should Be Documented?

Potential losses can include forensic investigation costs, data-recovery expenses, operational interruption, reconstruction costs and other directly provable financial consequences.

Keep invoices and internal records from the beginning.

Lost Profit Claims Require Strong Evidence

A company claiming that deletion caused loss of customers or contracts should preserve evidence connecting the deletion with those commercial consequences.

Speculative calculations may be difficult to establish.

What If the Data Were Fully Restored?

Successful restoration does not necessarily answer whether unlawful conduct previously occurred.

However, restoration can significantly affect the nature and amount of the company’s financial loss.

Employer’s Own Security Failures May Become Relevant

If a former employee retained administrator privileges long after they were needed, the company should review its own security procedures.

That does not automatically eliminate employee responsibility, but it may explain how the incident occurred and help prevent recurrence.

Access Should Be Removed at the Appropriate Time

A structured departure procedure should coordinate human resources and IT.

Company accounts, remote access, cloud permissions and administrator privileges should be reviewed when an employee’s employment ends.

Preserve Evidence Before Closing Accounts

Immediate account closure can be necessary for security, but relevant logs and mailbox information should first be preserved where possible.

Security and evidence preservation should occur together.

Notify Relevant Internal Teams

Legal, IT security, management and human resources should coordinate the response.

Uncoordinated internal investigations can result in overwritten evidence or inconsistent statements.

Prepare an Incident Chronology

Record when resignation was submitted, when suspicious activity occurred, when access was restricted, when deletion was discovered, when devices were recovered and when backups were restored.

A clear chronology can substantially improve the investigation.

Foreign-Owned Companies Should Preserve Evidence in Turkey

Multinational businesses may automatically send devices or logs to foreign headquarters.

Before doing so, consider the evidentiary, privacy and procedural consequences in Turkey. Relevant evidence should remain identifiable and capable of being produced if requested during Turkish proceedings.

Avoid Public Accusations Before the Evidence Is Clear

Publishing allegations about the former employee can create unnecessary additional disputes.

Internal investigation and formal legal procedures are generally safer than public accusations.

Immediate Action Checklist for the Company

When a former employee is suspected of deleting corporate data before resigning, the company should:

1. Restrict further unauthorized access without destroying existing logs.
2. Preserve the employee’s company devices and relevant cloud records.
3. Create forensic copies where appropriate.
4. Preserve backups before restoration.
5. Identify the deleted files and their business importance.
6. Reconstruct the access and deletion timeline.
7. Review the employee’s authorization and company policies.
8. Investigate possible copying or external transfer separately.
9. Preserve contracts, messages and access records.
10. Evaluate criminal, employment, civil, commercial and data-protection remedies together.

Frequently Asked Questions

Can an employee be criminally liable for deleting company files before resigning?

Potentially. Liability depends on the nature of the data, employee’s authorization, conduct, intent and the statutory elements of the relevant offense.

Does authorized access mean the employee can delete the files?

Not necessarily. Permission to access information for work does not automatically include authority to destroy company data.

Can deleted files be recovered?

Sometimes. Recovery depends on the system, storage technology, backups and subsequent use of the device. Digital-forensic examination may also identify evidence of deletion.

Are company server logs valid evidence?

They can be important digital evidence, but their source, integrity, completeness and interpretation should be established properly.

Can the company examine the employee’s personal laptop?

The company should not assume it has unrestricted authority to search a privately owned device. Privacy, ownership and criminal-procedure considerations must be evaluated.

What if the employee copied the files before deleting them?

The copying and deletion should be investigated separately. Confidentiality, trade-secret and personal-data issues may also arise.

Can WhatsApp messages be used as evidence?

Potentially, depending on how they were obtained and authenticated. Complete digital records can be more reliable than isolated screenshots.

Can the employer claim compensation?

Potentially, if unlawful conduct caused provable financial loss and the necessary causal relationship can be established.

Should the company restore the backup immediately?

Business continuity may require rapid restoration, but the pre-restoration condition and relevant digital evidence should first be preserved wherever practicable.

What should the company do first?

Preserve the evidence before attempting to prove the accusation. A company that immediately reformats computers, deletes accounts or overwrites logs may unintentionally destroy the strongest evidence concerning who deleted the data, when it happened and what was affected.

Client-Focused Legal Support for Employee Data Deletion and Cybercrime Investigations in Turkey

Deletion of corporate information by a departing employee can involve criminal investigation, digital forensics, unauthorized system interference, confidential information, personal data, trade secrets, compensation and urgent protective measures. Fırat Fesih Kaya Law Office assists Turkish and foreign-owned companies in investigating suspected employee data deletion and protecting digital evidence. Lawyer Fırat Fesih Kaya provides legal assistance in preparing criminal complaints, coordinating digital-evidence strategy, assessing employee authorization and criminal liability, protecting confidential corporate information and pursuing related compensation and judicial remedies.

Phone:
+90 312 434 22 22

Mobile:
+90 532 769 22 22

Email:
info@firatfesihkaya.av.tr

Address:
Mevlana Boulevard No:221, Yıldırım Tower, Office No:148, 06520 Balgat, Çankaya, Ankara, Turkey