New Principle Decision on Explicit Consent and Information Provision Processes

The Personal Data Protection Board (“the Board“) has introduced significant regulations regarding explicit consent and the obligation to inform data subjects through its Principle Decision dated 18.02.2026 and numbered 2026/347 (“the Principle Decision“). The aforementioned Principle Decision was published in the Official Gazette dated 24.03.2026 and numbered 32851.

The obligation to inform essentially entails informing data subjects whose personal data is being processed; Explicit Consent, on the other hand, is one of the processing conditions stipulated in the Law on the Protection of Personal Data No. 6698 (“Law“) for the lawful processing of personal data. The Board has introduced specific regulations to prevent errors in practice, emphasising that these two concepts are distinct in nature.

• Requirement to separate the texts: Where personal data processing activities are carried out on the basis of the condition of explicit consent, the clarification text and the explicit consent form must be drafted separately and presented to the data subjects. Even if these texts appear on a single page, as the declarations to be made by the data subjects differ in nature, both texts must be presented separately, one above the other, and separate declarations must be made for each text.

• Changes to the wording of declarations in the clarification text: Instead of the commonly used phrases in clarification texts such as “I have read and accept”, “I have read and give my explicit consent”, or “I have read and approve”, it will be considered legally compliant to state only “I have read and understood” to indicate that the clarification text has been read and understood by the data subject. No approval or consent should be sought for the statements contained in the clarification text. 

• The obligation to inform must be fulfilled in all circumstances: The obligation to inform must be fulfilled in all cases, prior to commencing the processing of personal data, irrespective of whether the data subject has made a request or given any approval, and regardless of which of the processing conditions listed in the Law — including explicit consent — the personal data processing activity is based upon.
  
  
• An explicit consent form must not be presented in cases where explicit consent is not required: Where the processing of personal data is carried out on the basis of any of the other processing conditions listed in the Law, other than the condition of explicit consent, it is sufficient to fulfil the obligation to inform; an explicit consent form must not be presented to data subjects.
  
  
• The use of template texts is prohibited: The exact same text prepared by another data controller must not be used; texts must be adapted by each data controller to suit their own organisation and activities.

• Language and content standards: The text must be written in clear, understandable and plain language; it must not contain general, ambiguous, incomplete, misleading or incorrect information. The Principle Decision also states that overly detailed, complex and lengthy texts must not be used; for example, instead of reproducing the entirety of Article 11 of the Law, a brief statement such as “your rights under Article 11 of the Law” will be deemed sufficient.

• The data processed and the legal grounds must be clearly stated: In clarification texts, the personal data processed and their categories, together with the purpose and legal grounds of the personal data processing activity, must be expressed in a clear and unambiguous manner.

The Board’s Principle Decision establishes a clear compliance standard for data controllers not only regarding the format of the texts but also concerning the legal framework of data processing procedures. Failure to comply with these rules may give rise to risks such as inadequate measures, unlawful data processing, the invalidity of explicit consent obtained, and administrative monetary fines.