DPA Principle Decision: Obligation to Inform and Explicit Consent Management

The Principle Decision titled "On the Requirement for Data Controllers to Prepare Explicit Consent Texts and Obligation to Inform Separately", issued by the Turkish Personal Data Protection Board ("Board") with decision number 2026/347 dated February 18, 2026, was published in the Official Gazette dated 24 March 2026 and numbered 33203, and has thereby entered into force.

With this Principle Decision and the accompanying public announcement, significant structural changes and compliance requirements have been introduced regarding the practices of data controllers in relation to their obligation to inform and explicit consent processes.

Requirement to Separate the Obligation to Inform from Explicit Consent Processes

The Board has identified, as one of the most common unlawful practices, the presentation of obligation to inform and explicit consent texts within a single document or in an intertwined manner, and has explicitly deemed such practices non-compliant.

Accordingly:

• Obligation to inform and explicit consent texts must be prepared separately,
• Each must be subject to independent declarations,
• Even if presented on the same platform, they must be structured under separate headings and distinct processes

Legal Nature of Obligation to Inform and Prohibition of Approval Mechanisms

The Decision clarifies that obligation to inform are instruments intended solely for informing data subjects and cannot be made subject to any approval or consent mechanism.

In this context:

• Requiring approval through statements such as "I have read and accept" is considered unlawful,
• Obligation to inform must not be structured as contractual terms or acceptance conditions,
• Data subjects may only be asked to confirm that they have read and been informed, without this constituting consent.

Scope and Timing of the Obligation to Inform

The Board emphasizes that the obligation to inform:

• Is not dependent on the request of the data subject,
• Applies regardless of the legal basis relied upon for data processing (including explicit consent),
• Must be fulfilled prior to the commencement of personal data processing activities

Furthermore:

• Where processing is based on explicit consent, both obligation to inform and separate explicit consent are required,
• Where processing relies on other legal grounds under the Law, only the obligation to inform should be provided, and explicit consent should not be requested

Content Requirements and Drafting Standards

The Board has also set out key compliance criteria regarding the content of such texts. Accordingly:

• Obligation to inform must include all elements stipulated under Article 10 of the Law No. 6698,
• The categories of personal data processed, purposes of processing, and legal grounds must be stated clearly and explicitly,
• Information regarding data transfers must be accurate and not misleading

The following practices are explicitly considered non-compliant:

• Using texts prepared by other data controllers without adaptation,
• Including vague, generic, or ambiguous statements,
• Providing misleading or incorrect information to data subjects,
• Using excessively long, complex, or incomprehensible texts

Therefore, all texts must be drafted in a clear, simple, understandable, and organization-specific manner.

The Board’s Principle Decision clearly establishes that necessity to strictly separate the processes of informing and obtaining explicit consent ,not to link the obligation to inform to any approval mechanism, and to structure the texts in compliance with the legislation in terms of both content and language; in this context, good and bad practice examples were also included in the annex of the decision in order to provide guidance to practitioners regarding the obligation to inform.

You may access the full text of the Principle Decision here (In Turkish), and the public announcement published by the Turkish Data Protection Authority here (In Turkish).