New Decision of the Turkish Personal Data Protection Board on Disclosure and Explicit Consent Practices

The decision of the Personal Data Protection Board (the “Board”) dated 18.02.2026 and numbered 2026/347 (the “Decision”) regarding common errors made by data controllers in disclosure and explicit consent processes was published in the Official Gazette dated 24 March 2026 and numbered 33203.

COMMON NON-COMPLIANCE ISSUES IN PRACTICE

The Decision lists the following common violations identified in practice:

• Merging explicit consent and disclosure notices into a single document,
• Requesting approval/consent from data subjects to confirm that disclosure has been made,
• Using notices prepared by other data controllers without adapting them to the data controller’s own activities,
• Using generic, ambiguous, incomplete, misleading, and inaccurate information in disclosure notices instead of clear, comprehensible, and plain language,
• Using excessively detailed, complex, and lengthy notices.

The Board emphasised that presenting explicit consent notices and disclosure notices as a single merged document is one of the most frequently encountered violations. The Board further explained that the disclosure and explicit consent processes are conceptually and functionally distinct and must be presented as separate documents.

KEY CONSIDERATIONS FOR DISCLOSURE AND EXPLICIT CONSENT PROCESSES

The Board stated that the following points must be observed in disclosure and explicit consent processes:

• The disclosure obligation must be fulfilled before data processing begins and in all cases, regardless of the legal basis for processing,
• Where processing is based on explicit consent, the disclosure notice and the explicit consent notice must be prepared as separate documents under distinct headings (even if they appear on the same page), and a separate acknowledgment must be obtained for each,
• Where processing is not based on explicit consent, only a disclosure notice should be provided, without presenting an additional explicit consent notice,
• Data subjects should only be asked to acknowledge that they have read and understood the disclosure notice; approval or consent should not be requested for the disclosure notice itself,
  • For example, using phrases such as “I have read and I understand” rather than “I have read and I accept” in disclosure notices,
• Pre-drafted notices should not be copied directly from other data controllers; each data controller must prepare its notices in accordance with its own organisational structure and activities,
• Clear, comprehensible, and plain language must be used in notices; generic, ambiguous, incomplete, misleading, or inaccurate information that may confuse data subjects must be avoided,
  • For example, refraining from using language that creates the impression that data is transferred abroad when no such transfer takes place,
• Excessively detailed, complex, and lengthy notices should be avoided,
  • For example, instead of reproducing the full text of Article 11 of the Law, which would unnecessarily lengthen the notice, it is preferable to use a formulation such as “your rights under Article 11 of the Law”.

• The personal data processed and their categories, as well as the purposes and legal bases of the data processing activities, must be clearly and explicitly stated in the disclosure notices.

CONCLUSION AND ASSESSMENT

In its Decision, the Board has made significant observations with the aim of identifying common errors in disclosure and explicit consent processes, and demonstrating best practices in this regard. Indeed, the annex to the Decision provides further illustrations of good and bad practices through a sample template. The Decision is particularly important in terms of the separation of disclosure and explicit consent processes, the simplification of notices, and the emphasis on the principle of intelligibility. Since non-compliance with the requirements set out in the Decision may give rise to risks of unlawful data processing, invalidity of explicit consent, and associated administrative fines, it is recommended that particular attention be paid to the separation of these processes and that disclosure notices be revised in line with the best practices established by the Board.