Principle Decision on the Separation of Privacy Notice and Consent

The “Principle Decision on the Requirement to Prepare Explicit Consent and Privacy Notice Texts Separately” (“Decision”), dated 18 February 2026 and numbered 2026/347, issued by the Personal Data Protection Board (“Board”), was published in the Official Gazette dated 24 March 2026 and numbered 33203, setting forth important principles regarding the preparation of privacy notices and explicit consent texts.

The Decision clearly establishes that the obligation to inform must be fulfilled prior to the commencement of personal data processing and in all cases regardless of the legal basis relied upon, whereas explicit consent must be obtained separately only where it is genuinely required as a legal basis for the relevant processing activity. In this context, it is emphasized that privacy notices and explicit consent texts must be drafted prepared separately and, where presented in the same medium, structured under separate headings and supported by separate declarations of will..

The Decision also addresses common mistakes observed in practice, stating that the use of statements such as “I have read and accept” or “I give my explicit consent” within the scope of the privacy notice, the intertwining of the obligation to inform with explicit consent, and obtaining explicit consent where it is not required constitute unlawful practices. It is further underlined that data controllers must ensure that all texts are clear, plain, and comprehensible, that the relevant data categories, processing purposes, legal grounds and data transfer details are clearly specified, and that texts are not copied from other sources without proper adaptation.

Finally, the annex to the Decision includes examples of both compliant and non-compliant practices, thereby providing practical guidance. The Decision further indicates that these requirements constitute administrative and technical measures to be implemented by data controllers, and that non-compliance may result in sanctions under the Personal Data Protection Law numbered 6698.

You may access the Decision here.