The Personal Data Protection Board (“Board”) published its Principle Decision dated 18 February 2026 and numbered 2026/347 in the Official Gazette dated 24 March 2026 and numbered 33203 (“Principle Decision”). The Principle Decision concerns the requirement to prepare explicit consent texts and privacy notices separately.
The Board considers presenting explicit consent texts and privacy notices within a single text as one of the most common unlawful practices in application. It states that these two concepts have different legal natures and therefore must be prepared as separate texts.
Under the Personal Data Protection Law No. 6698 (“DP Law”), the obligation to inform refers to informing data subjects about personal data processing activities, while explicit consent constitutes one of the legal grounds for processing. The Board states that explicit consent must relate to a specific matter, be based on information, and be given freely, and that the burden of proof for valid consent lies with the data controller
The Board also states that the obligation to inform under Article 10 of the DP Law must be fulfilled in all cases and before data processing begins, regardless of the legal ground relied upon for the processing activity.
Referring to the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, the Board states that the processes of informing and obtaining explicit consent must be carried out separately. Even if the texts appear on the same page, they must be presented under separate headings and include separate declarations.
The Principle Decision also identifies common unlawful practices in application. These include presenting explicit consent and privacy notices as a single text, requesting approval for the privacy notice, using texts prepared by other data controllers without adaptation, and failing to use clear and understandable language.
In this context, the Board sets out the following obligations for data controllers:
- fulfilling the obligation to inform independently of any request from the data subject and before starting data processing,
- preparing explicit consent texts and privacy notices separately where processing is based on explicit consent,
- structuring the texts under separate headings and requiring separate declarations even if they are presented on the same page,
- fulfilling only the obligation to inform where processing relies on legal grounds other than explicit consent and not requesting explicit consent,
- obtaining only confirmation that the privacy notice has been read and understood and not requesting approval or consent for its content,
- preparing texts in line with the data controller’s own activities and not using texts prepared by others without adaptation,
- using clear, simple, and understandable language and avoiding misleading or ambiguous statements,
- avoiding unnecessarily long and complex texts,
- clearly specifying the categories of personal data processed, the purposes of processing, and the legal grounds.
The Board states that these matters constitute technical and administrative measures under Article 12 of the DP Law. It also states that failure to comply with these obligations may result in administrative sanctions under Article 18 of the DP Law.
Finally, the Principle Decision includes sample texts illustrating both good and poor practices regarding privacy notices and explicit consent texts.
You can access the full text of the Principle Decision here. (only available in Turkish)
