The principles of transparency and accountability, which constitute the fundamental principles of the data protection law, are practically shaped through the data controllers’ obligation to inform and the concepts of explicit consent of the data subject. However, in practice, it has been observed that these two (2) independent principles are frequently confused by data controllers or combined under the same approval mechanism.
The Personal Data Protection Board (“Board”), addresses this frequently encountered issue in data protection practices with its principle decision numbered 2026/347, published on 18.02.2026 (“Principle Decision”), This principle decision published in the Official Gazette dated 04.03.2026 and numbered 33203, states that the obligation to inform and explicit consent mechanisms must be strictly separated from each other and foresees critical structural changes for data controllers.
1. Summary of the Decision
In accordance with Article 15, Paragraph 6 of the Personal Data Protection Law with numbered 6698 (“DPL”), the Board is authorized to adopt and publish a principle decision in cases where a violation is determined to be widespread, whether as a result of a complaint or an ex officio investigation.
The Board has commonly identified in practice that data controllers have been merging the texts used to fulfill their statutory obligation to inform with the explicit consent texts, which serve as a legal basis for data processing, under a single document or a single approval button. The Board stated that this practice prevents the public from fully understanding what they are consenting to and leads to the vitiation of intent. In accordance with the authority granted under the DPL, the Board has clearly established in the said Principle Decision that these two concepts are independent processes.
In line with the explanation of the Board, the following basic points are explained;
- The obligation to inform is a statutory requirement that must be fulfilled prior to any data processing activity, regardless of the legal basis upon which such processing relies. Privacy notices must not request consent from data subjects; instead, they should only obtain feedback acknowledging that the information has been provided.
- Explicit consent is merely one of the data processing conditions set forth in the Law and possesses its own distinct legal nature. If personal data is being processed based on legal grounds other than explicit consent, no consent should be sought; instead, only the obligation to inform must be fulfilled. Furthermore, data controllers must refrain from using verbatim copies of notices belonging to other institutions and must instead draft bespoke notices tailored to their specific activities.
- Therefore, in data processing activities conducted based on explicit consent, the information notices and explicit consent texts must be prepared separately; even if they are presented on the same page, their contents and declarations must be strictly decoupled, and the simultaneous execution of both processes through a single approval must be prevented.
2. Legal Assessment and Recommendations
The basis of the Board’s Principle Decision is directly derived from the mandatory provisions of the DPL. Article 10 of the DPL imposes an obligation on the data controller to inform the data subject during the collection of personal data regarding the controller’s identity, the purpose of processing, transfer conditions, the method and legal basis for data collection, and the rights stipulated under Article 11. This process constitutes a unilateral declaration of information.
On the other hand, in subparagraph (a) of the 1st paragraph of Article 3 of the DPL, explicit consent is defined as: “consent regarding a specific subject, based on information and expressed with free will.” Pursuant to Article 5 of the DPL, as a rule, personal data cannot be processed without the explicit consent of the data subject. However, in the event of the existence of one of the conditions listed in the 2nd paragraph of Article 5, such as being clearly prescribed by law, the performance of a contract, or the fulfillment of a legal obligation, it is possible to process data without seeking explicit consent.
The legal basis of the Principle Decision rests exactly at this point, on the systematic interpretation of Articles 3, 5, and 10 of the DPL. If the clarification text and the explicit consent text are linked to a single approval mechanism, “free will,” which is one of the elements of consent, is impaired. The data controller’s fulfillment of the obligation to inform does not mean that the data subject consents to it, and its presentation as a text forced for approval is legally meaningless.
The principles of “Being in compliance with the law and honesty rules” and “Being processed for specific, clear and legitimate purposes” in Article 4 of the DPL necessitate that clarification texts be simple, understandable, and prepared in a way that is far from being ready-made copy-paste texts. Designing the texts separately in line with the Principle Decision can also be evaluated within the scope of “administrative measures” ensuring the compliance of the data processing activity with the law.
If it is mandatory to have both texts on the same page (for example, on the same form on a website) in line with the Principle Decision, the texts should be presented under different headings one below the other, and separate declarations should be obtained from the data subject for both texts. It should be noted with importance that clarification texts are not a contract to be approved. For this reason, only feedback should be received from the data subjects that the clarification text has been read and information has been obtained. Requesting approval or consent from the data subject for the statements in the clarification text should strictly be avoided.
Singular approval boxes such as “I have read the clarification text and I consent to the processing of my data,” which have been encountered on many websites, mobile applications, and physical stores until today, have become contrary to the law. Data controllers must immediately update all digital and physical data collection interfaces, business processes, and legal texts to reflect this distinction.
3. Conclusion and Sanction
With this Principle Decision, the Board has established a definitive rule regarding the separation of the concepts of obligation to inform and explicit consent on physical or digital documents. The Board has categorized the requirement to prepare separate notices for explicit consent and information, as well as the necessity to comply with the aforementioned rules, as part of the ‘administrative and technical measures’ within the scope of Article 12, Paragraph 1 of the DPL.
Consequently, data controllers who fail to comply with this principle decision shall be deemed to have failed in fulfilling their obligations regarding data security; and in accordance with the provisions of Article 18 of the DPL, administrative fines and relevant sanctions shall be imposed upon them.
Data controllers must urgently revise all clarification and explicit consent processes, digital and physical forms in light of this decision in order not to face a legal sanction.
Frequently Asked Questions
- Can the clarification text and explicit consent text be located on the same page or screen?
Answer: Yes, they can. However, pursuant to the Principle Decision, even if these texts are presented on the same page, the content and declarations must be completely segregated from each other, presented under different headings, and the two processes must not be carried out together with a single approval mechanism.
- Do I have to get approval from the data subject for clarification texts?
Answer: No, the obligation to inform is a unilateral information process. Pursuant to the Principle Decision, approval should not be obtained for the statements in the clarification text; it should be preferred to receive only a feedback (such as read/understood) regarding the provision of information to the data subject.
- What path should be followed if our data processing activity is based on a legal condition other than explicit consent, such as the performance of a contract?
Answer: In case personal data is processed based on other legal grounds other than the condition of explicit consent within the scope of DPL Article 5/2 (for example, performance of a contract or legal obligation), explicit consent should not be obtained from the data subject; only the obligation to inform should be fulfilled.
- Can I use a clarification text carefully prepared by another company by copying it on my own website?
Answer: This would not be a correct use. The Principle Decision states in a clear language that data controllers must prepare the texts they use specifically for their own activities, data processing purposes, and legal reasons, and that texts belonging to other institutions should not be copied and used exactly.
- What kind of legal sanctions are encountered if explicit consent and clarification texts are not separated duly?
Answer: Not segregating the texts in accordance with the rules is evaluated as not taking the administrative measures within the scope of DPL Article 12, and in case of violation, data controllers may face administrative fines pursuant to DPL Article 18.
For a free initial assessment and consultation:
nazli@npartners.com.tr | info@npartners.com.tr | oyku@npartners.com.tr | alikaan@npartners.com.tr