Explicit Consent And The Obligation To Inform Per The Protection Of Personal Data

The provisions regarding the obligations to inform and to obtain explicit consent, which are among the most significant obligations imposed on data controllers by the Law on the Protection of Personal Data No. 6698 ("Law"), form the basis for the lawful processing of personal data. In this respect, data controllers' obligation to clearly inform data subjects before commencing data processing activities and to obtain their explicit consent where necessary is of critical importance for the effective fulfillment of the data protection obligations as stipulated by the Law.

While the obligation to inform ensures that data subjects are aware of which of their data is being processed, for what purposes, and on what legal grounds; explicit consent, as a declaration of will made by the data subject based on sufficient information and in accordance with their free will regarding a specific matter, confers legal validity on data processing activities. This article will examine the scope, practical application, and relationship between these two obligations within the framework of the Law and relevant legislation.

A. Obligation to Inform

Pursuant to Article 10 of the Law, during the collection of personal data, data controllers or persons authorized by the data controllers must inform data subjects in a manner that includes the following details:

1. The identity of the data controller (and, if applicable, its representative),
2. The purpose for which personal data will be processed,
3. To whom and for what purpose the processed personal data may be transferred,
4. The method and legal basis for collecting personal data,
5. The rights the data subject may exercise against the data controller*

* These rights are listed under Article 11 of the Law as follows:

1. The right to inquire whether personal data is being processed,
2. The right to request information regarding the processing of personal data if it has been processed,
3. The right to learn the purpose of processing personal data and whether it is being used in accordance with that purpose,
4. To know the third parties to whom personal data has been transferred within or outside the country,
5. To request the correction of personal data if it has been processed incompletely or incorrectly,
6. To request the deletion or destruction of personal data in accordance with the conditions set forth in Article 7 of the Law, which regulates the deletion, destruction, or anonymization of personal data,
7. To request that the actions taken pursuant to subparagraphs (e) and (f) above be notified to third parties to whom personal data has been transferred,
8. Objecting to a decision made solely through the automated processing of data that adversely affects the individual,
9. Requesting compensation for damages incurred due to the unlawful processing of personal data.

Under the Communique issued by the Personal Data Protection Authority regarding the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform ("Communique"), as it is stated that the information topics listed above have been determined as a minimum, an information notice that does not include any of these topics may be deemed invalid and could result in the failure to fulfill the information obligation arising from the legislation.

In accordance with the Communique, the obligation to inform must be fulfilled using physical or electronic means such as oral communication, written documents, audio recordings, or call centers, and the following procedures and principles must be followed in fulfilling the obligation to inform:

• The obligation to inform must be fulfilled in every instance where personal data is processed based on the data subject's explicit consent or other processing conditions set forth in the Law. This obligation must be fulfilled no later than the time the data is processed and must not be fulfilled after the data has been processed.

• If the purpose of processing personal data changes, the obligation to inform must be fulfilled separately for this purpose prior to the data processing activity.
• If there is an obligation to register with Data Controller Registry (VERBİS), the information provided to the data subject under the obligation to inform must be consistent with the information disclosed to VERBİS.

• Fulfilling the obligation to inform is not contingent upon the data subject's request. The data controller must fulfill this obligation on its own initiative without the need for the data subject to submit a separate and explicit request for such information.

• The burden of proof that the obligation to inform has been fulfilled rests with the data controller. For this reason, obtaining a written statement confirming that the obligation to inform has been fulfilled will facilitate proof for the data controller.
• If the processing of personal data is based on the condition of explicit consent, the obligation to inform and the process of obtaining explicit consent must be fulfilled separately. In its Principle Decision issued in February 2026, the Personal Data Protection Board also explicitly stated that information notes and explicit consent texts must be drafted separately, and clearly ruled that the "single text" approach frequently encountered in practice is not in compliance with the law.
• The purpose of personal data processing to be disclosed under the obligation to inform must be specific, clear, and legitimate. When fulfilling the obligation to inform, general or vague expressions should not be used. Statements that might give the impression that personal data could be processed for other purposes that may arise in the future should not be used.
• The notification to be provided to the data subject under the obligation to inform must be made using clear, straightforward, and simple language.
• In Article 10 of the Law, which regulates the matters the data controller must inform data subjects about, the term "legal basis" in the phrase "the method and legal basis of personal data collection" refers to the specific processing condition detailed in Articles 5 and 6 of the Law upon which the processing of personal data is based. The legal basis must be clearly stated when fulfilling the obligation to inform.

• Under the obligation to inform, the purpose of transferring personal data and the recipient groups to whom it will be transferred must be specified.

• Under the obligation to inform, it must be clearly stated whether personal data was obtained entirely or partially by automated means or by non-automated methods, provided that such methods form part of a data recording system.
• When fulfilling the obligation to inform, incomplete, misleading, or incorrect information must not be included.

If personal data cannot be obtained from the data subject, the data controller must fulfill the obligation to inform (i) within a reasonable period from the time the personal data is obtained, (ii) at the time of the first communication if the personal data is to be used for communication with the data subject, and (iii) no later than the time of the first transfer of the personal data if the data is to be transferred.

B. Explicit Consent

Under the Law and the Explicit Consent Guide published by the Authority, it is stipulated that explicit consent must be (i) clearly related to a specific matter, (ii) based on information provided, and (iii) freely given.

i. Under the criterion of relating to a specific matter, the subject matter to which the statement of explicit consent pertains must be clearly stated; therefore, vague statements of consent such as "I consent to the processing of my personal data" are not considered valid under the Law.

If personal data is to be processed across multiple categories, the consent given must separately and clearly specify which personal data will be processed and for what purposes.

ii. Regarding the requirement that explicit consent be based on information, it is important to note that explicit consent is a declaration of intent and must be freely given by data subjects. The data subject must be fully informed about what they are consenting to and the consequences of their consent before giving it. This information must be provided in a clear and understandable manner prior to the processing of personal data.

The relevant information must clearly specify the purposes for which the personal data to be collected will be used, and terms or writing styles that would make it difficult for the data subject to understand the information must not be used

iii. For explicit consent to be valid, the data subject must be aware of the action they are taking, and this action must arise from the data subject's decision and free will; consequently, if consent is given under circumstances such as threat, error, or fraud, this may result in the invalidity of the explicit consent. Furthermore, obtaining explicit consent should not be presented as a prerequisite for the provision of a service or for benefiting from a service.

Pursuant to Article 5 of the Law, personal data may not be processed without the data subject's explicit consent; however, the processing of personal data without explicit consent is permitted if one of the circumstances listed in the Law and specified below exists:

1. Where expressly provided for by law.
2. It is necessary to protect the life or physical integrity of the individual—who is unable to express consent due to actual impossibility or whose consent lacks legal validity—or of another person.
3. The processing of personal data belonging to the parties to a contract is necessary, provided it is directly related to the conclusion or performance of the contract.
4. It is necessary for the data controller to fulfill its legal obligations.
5. The data has been made public by the data subject themselves.
6. Data processing is necessary for the establishment, exercise, or defense of a legal claim.
7. It is necessary for the data controller's legitimate interests, provided that such processing does not infringe upon the data subject's fundamental rights and freedoms.

It is not mandatory for only one of these conditions to be present; multiple conditions may apply. In such cases, the conditions for data processing must be examined separately, and the methods of processing the data must also be evaluated individually.

Before commencing data processing, it must first be determined whether any legal grounds other than explicit consent exist; if none of these grounds apply, the method of obtaining explicit consent must be applied for.