Principle Decision of the Personal Data Protection Board on the Separate Preparation of Explicit Consent and Privacy Notices Published

The Principle Decision of the Personal Data Protection Board (Board) dated 18.02.2026 and numbered 2026/347, titled “Principle Decision on the Requirement for Data Controllers to Prepare Explicit Consent and Privacy Notices Separately,” published in the Official Gazette dated 24 March 2026 and numbered 33203.

Within the scope of this Principle Decision, unlawful practices frequently encountered in practice were evaluated, and the principles that data controllers must comply with while fulfilling their obligations regarding explicit consent and the duty to inform were clarified; additionally, examples of good and bad practices were included in the annex of the decision.

The key points are summarized below:

• Due to their distinct legal nature, explicit consent and the obligation to inform must be addressed through separate texts.
• The obligation to inform must be fulfilled prior to the commencement of any data processing activity, regardless of the legal basis relied upon.
• Where data processing is based on explicit consent, privacy notices and explicit consent texts must be prepared as separate documents under different headings. If both texts are presented on the same page, they must be clearly distinguishable and include separate declarations.
• In cases where explicit consent is not required, it is sufficient to fulfill only the obligation to inform, and no explicit consent should be obtained.
• Data subjects should not be requested to provide consent within the privacy notice; only a declaration confirming that the notice is read and understood should be obtained.
• Both privacy notices and explicit consent texts must be drafted in a clear, plain, and understandable language; and misleading, incomplete, or overly generic expressions must be avoided.
• Texts prepared by other data controllers must not be used as-is; each data controller should prepare texts tailored to its own activities.
• Overly long, complex, and unnecessarily detailed texts should be avoided, and the purposes of personal data processing and the legal grounds must be clearly and explicitly stated.