Key Considerations for Processing Personal Data Obtained from Third Parties

The Turkish Personal Data Protection Authority (KVKK), in its public announcement published on July 21, 2026, provided important guidance regarding the use of contact information obtained from third parties for advertising and marketing activities.

During its investigations, the Authority found that companies have been contacting prospective customers using telephone numbers, email addresses, and other contact information obtained from existing customers, business partners, referrals, or other third parties. However, it was observed that the obligations set forth under the Turkish Personal Data Protection Law (Law No. 6698) have not always been fulfilled in these processes.

The fact that contact information has been shared by a third party does not, by itself, constitute a legal basis for processing such personal data for advertising or marketing purposes.

To lawfully process personal data, data controllers must rely on at least one of the legal grounds set out in Article 5 of Law No. 6698, or, where required, obtain the explicit consent of the data subject.

Even where personal data is not collected directly from the data subject, the data controller's obligation to provide information remains applicable.

Pursuant to the applicable legislation, data controllers are required to inform the data subject under Article 10 of Law No. 6698:

• Within a reasonable period after obtaining the personal data,
• At the time of the first communication, where the personal data is used to contact the individual or
• Before the first disclosure of the personal data to a third party, where applicable.

Another important issue that is often overlooked by data controllers is that the obligation to inform and the requirement to obtain explicit consent are two separate legal obligations.

Accordingly, the data subject must first be duly informed. Where explicit consent is required as the legal basis for processing, it must then be obtained separately, based on the individual's free and informed will.

Providing the required information alone does not authorize the processing of personal data, just as obtaining explicit consent does not eliminate the obligation to provide the required information.

Companies engaged in advertising and marketing activities should ensure that they:

• Identify an appropriate legal basis before using contact information obtained from third parties,
• Fulfill the obligation to inform in accordance with the relevant Communiqué and applicable legislation,
• Obtain explicit consent separately and in accordance with legal requirements where necessary,
• Refrain from interpreting silence, failure to end a conversation, or similar conduct as valid explicit consent,
• Ensure that all marketing activities conducted via call centers, SMS, email, or other communication channels comply with the Turkish Personal Data Protection Law and related legislation and
• Maintain adequate records capable of demonstrating compliance where required.

You may access the relevant announcement here. (In Turkish)