The Personal Data Protection Authority has prepared the “Principle Decision on the Requirement for Data Controllers to Arrange Explicit Consent Form and Information Texts Separately” (“Principle Decision”), which was published in the Official Gazette No. 33203 dated March 24, 2026.
In the Principle Decision, the concepts of explicit consent form and privacy notice are examined within the scope of the legislation, and evaluations are provided regarding unlawful practices frequently encountered in practice. In summary, the Authority has emphasized the following matters:
- The purpose of privacy notices is to provide information and they do not have the nature of a contract; therefore, expressions indicating a declaration of will such as “I have read and accept,” “I have read and give consent,” or “I have read and approve” should be avoided, and expressions such as “I have read and understood” should be preferred.
- Explicit consent form is a declaration of will based on information and is therefore different from the privacy notice. It should include a statement such as “I give my explicit consent for the processing of my personal data.”
- When the processing of personal data depends on the condition of explicit consent, the privacy notice and the explicit consent form must be arranged under separate headings as distinct texts.
- If the privacy notice and the explicit consent form are arranged on the same page, they should be structured under separate headings with a separate declaration obtained for each text.
- If the processing of personal data is based on other legal grounds stipulated in the Law No. 6698 rather than explicit consent, fulfilling the obligation to inform alone is sufficient, and no separate consent should be obtained.
- The texts should be prepared by each data controller in accordance with their own organization and sectoral activities.
- The texts should use clear, understandable, and simple language; general, ambiguous, incomplete, misleading, or incorrect information should be avoided, as well as unnecessarily detailed, complex, or lengthy texts.
Additionally, the Authority has included examples of good and bad practices in the annex to the Principle Decision.
If the practice is not properly implemented, data controllers are subject to administrative fines in accordance with Articles 12 and 18 of the Personal Data Protection Law.
The full text of the Principle Decision can be accessed here.
Best Regards,
Balay, Eryiğit & Erten
