The Personal Data Protection Board’s (the “Board”) Principle Decision No. 2026/347 (the “Decision”) has been published in the Official Gazette No. 33203 dated March 24, 2026. In its Decision, the Board stated that the provision of the texts for informing the data subject and for obtaining explicit consent within a single document, which was identified as one of the most frequently encountered violations in complaints and reports submitted to the Personal Data Protection Authority (the “Authority”), is contrary to the Law on the Protection of Personal Data No. 6698 (the “Law”).
Legal Nature of the Obligation to Inform and Explicit Consent
The obligation to inform, regulated under Article 10 of the Law, requires the data controller to notify data subjects, at the time of collection of their personal data, of the identity of the data controller, the purpose and legal basis of processing, the recipients to whom personal data may be transferred, the method of collection, and the data subject’s rights under the Law. This obligation must be fulfilled in all circumstances, regardless of the data subject’s request or approval and irrespective of the legal ground on which the data processing is based. Texts prepared to inform the data subject to fulfill this obligation do not constitute contractual documents.
Explicit consent, on the other hand, is defined under Article 3 of the Law as “consent relating to a specific subject, based on being informed, and expressed through free will.” It constitutes one of the legal grounds for processing personal data under Articles 5 and 6 of the Law. The burden of proving that explicit consent has been duly obtained in accordance with the Law rests with the data controller.
Obligations Imposed by the Decision
The Decision emphasizes that the obligation to inform must be fulfilled in all circumstances prior to the commencement of personal data processing, irrespective of the legal ground on which the processing is based.
Where personal data processing is carried out on the basis of explicit consent, the informing text and the text for obtaining explicit consent must be prepared under separate headings as distinct documents. Even if both texts appear on the same page, they must be positioned consecutively, and separate declarations must be obtained from data subjects for each text. In this context, the declaration regarding the informing text should be limited to confirming that the text has been read and the information has been received. No approval or consent should be requested in relation to the statements contained in the informing text.
The Board further clarifies in the Decision that where personal data is being processed based on a legal ground other than explicit consent, only the obligation to inform applies and a separate text for explicit consent should not be presented to data subjects.
Finally, the Board draws attention to the need for informing texts and the texts for obtaining explicit consent to be prepared by data controllers in a manner appropriate to their own activities. The use of texts prepared by another data controller without adaptation, including copying such texts verbatim, is considered unlawful.
Unlawful Practices Identified in Practice and Risk of Sanction
The Board, in its Decision, not only set out the correct practice but also drew attention, with concrete examples, to unlawful practices that remain widely encountered in practice. Among these, the presentation of the informing text and the explicit consent text as a single, intertwined document and the solicitation of approval or consent from data subjects in connection with the informing text are particularly prominent.
The Board further emphasized that informing texts must be drafted in clear, plain, and intelligible language. In this context, the use of statements that give the impression that personal data is transferred abroad when no such transfer actually takes place, or the use of vague and ambiguous expressions such as “your personal data is processed within the scope of the processing conditions set out in Articles 5 and 6 of the Law,” were cited as examples of violations. Conversely, the Board also noted that texts that are excessively detailed, complex, or unnecessarily lengthy should be avoided.
The Decision, adopted pursuant to Article 15 paragraph 6 of the Law, underscores that administrative sanctions may be imposed in the event that the identified violations continue. The Board highlighted that the matters set out above fall within the administrative and technical measures that must be taken by data controllers under Article 12 paragraph 1 of the Law and publicly announced that, where these obligations are not complied with, various administrative sanctions, including administrative fines, may be imposed on the relevant data controllers pursuant to Article 18 of the Law.
Please click here to access the full text of the Decision (available in Turkish only).