THE PRINCIPLE DECISION OF THE PERSONAL DATA PROTECTION BOARD REGARDING THE REQUIREMENT FOR DATA CONTROLLERS TO PREPARE EXPLICIT CONSENT TEXTS AND INFORMATION NOTICES SEPARATELY HAS BEEN PUBLISHED IN THE OFFICIAL GAZETTE
The Principle Decision (“Principle Decision”) dated 18/02/2026 and numbered 2026/347, adopted by the Personal Data Protection Board (“Board”), was published in the Official Gazette dated March 24, 2026 and numbered 33203. The obligation to inform is an obligation aimed at informing data subjects; whereas explicit consent is one of the legal grounds for the processing of personal data. In this context, a Principle Decision has been adopted stating that information notices and explicit consent texts, which have different legal natures, must be prepared separately.
Unlawful Practices Observed in Practice
- Combining explicit consent and information notices into a single text,
- Requesting additional approval/consent from data subjects to confirm that the obligation to inform has been fulfilled,
- Using texts belonging to different data controllers verbatim without adapting them to their own activities,
- Including ambiguous, misleading, or incomplete statements in information notices instead of using clear, plain, and understandable language, and preferring unnecessarily long, complex, and difficult-to-understand texts.
Situations Considered Lawful According to the Principle Decision
- In the processing of personal data, regardless of the legal ground relied upon (including explicit consent), the data controller must fulfil the obligation to inform in all cases and prior to the commencement of data processing,
- In processing activities based on explicit consent, preparing information notices and explicit consent texts under separate headings and as separate documents,
- Where information notices and explicit consent texts are presented on the same page, ensuring that they are prepared under separate headings and that separate declarations are obtained,
- In processing activities based on legal grounds set out in the Law other than explicit consent, providing only information and not requesting consent,
- Obtaining a declaration from data subjects solely confirming that the information notice has been read and understood, without requesting approval/consent for the content of the text,
- Not using texts belonging to other data controllers verbatim and preparing each text specifically tailored to its own activities,
- Using clear, plain, and understandable language in the texts; avoiding misleading or incomplete statements and refraining from unnecessary detail,
- Clearly and explicitly stating the types of data processed, the purposes of processing, and the legal grounds in the information notices.
Good and Bad Practice Templates According to the Decision
The templates included in the annexes at the end of the Decision present examples of good and bad practices prepared in accordance with the principle decision of the Personal Data Protection Board. The aim is to ensure that data controllers properly distinguish between the obligation to inform and the process of obtaining explicit consent.
Good Practice Template (Annex-1)
In this template, it is clearly observed that the information and explicit consent processes are separated from each other. The information notice is structured as a separate document and includes all elements required under the Personal Data Protection Law, such as the identity of the data controller, the purposes of processing personal data, transfer details, the method of data collection, and the rights of the data subject.
It has been demonstrated that, by including only the statement “I have read and understood” at the end of the information notice, what should be obtained from the individual is not consent, but a confirmation that they have been informed. Subsequently, the explicit consent text is presented as a separate section, and the data subject is granted a clear choice in the form of “I give explicit consent” or “I do not give explicit consent.”
Bad Practice Template (Annex-2)
In this template, the information notice and explicit consent have been unlawfully combined within a single text. It has been demonstrated that, within the scope of the text, the data subject is both informed and, at the same time, asked to provide consent based on the same content. This situation leads to the individual’s inability to distinguish between the information and consent processes and undermines the requirement that explicit consent be based on free will.
Please feel free to reach out to us, should you have any queries.
