The Principle Decision dated 18 February 2026 and numbered 2026/347, adopted by the Personal Data Protection Board (the Board), has been published in the Official Gazette dated 24 March 2026 and numbered 33203.
With the said Principle Decision, it has been clearly established that explicit consent texts and privacy notices must be prepared separately by data controllers.
The Board has assessed that practices frequently encountered in practice, such as presenting explicit consent and privacy notices within a single text, making the provision of privacy notices conditional upon obtaining explicit consent, or using general and vague expressions, constitute violations of the law.
In this context:
- The obligation to inform is defined as a requirement that must be fulfilled in all cases, regardless of whether the data processing activity is based on explicit consent.
- Explicit consent must be a statement relating to a specific subject, based on information and given by free will, and must be obtained separately and independently from the privacy notice.
- It has been explicitly stated that consent texts and privacy notices must be prepared as separate documents under distinct headings.
- Even if these texts are presented on the same page, it is mandatory that their contents and declarations be structured separately.
The Board has further determined that the following practices are unlawful:
- Requesting approval or consent from data subjects within the privacy notice.
- Combining explicit consent texts with privacy notices.
- Making the obligation to inform conditional upon consent through expressions such as I have read and accept.
- Using general, vague or ambiguous expressions covering multiple processing purposes.
- Using texts prepared by other data controllers without modification.
Furthermore, it has been emphasized that where personal data is processed based on legal grounds other than explicit consent, providing a privacy notice alone is sufficient and explicit consent should not be obtained.
The Board has established that, in the texts to be prepared by data controllers:
- Processing purposes and legal bases must be stated clearly and explicitly.
- Data subject categories and data categories must be distinctly specified.
- Explicit consent must be obtained in a manner that is specific, informed and based on free will.
With the Principle Decision, which entered into force upon its publication in the Official Gazette, it has been clearly set forth that data controllers are required to review the texts used in their personal data processing activities in terms of compliance with the Law on the Protection of Personal Data.
Should you have any questions regarding the matter, please feel free to contact us at any time.
For your information,
Kind regards.