I. Introduction
Privacy notices and explicit-consent declarations are frequently combined under one text or checkbox in website registrations, mobile applications, employee forms, loyalty programmes, patient records and marketing processes. The Turkish Personal Data Protection Board addressed recurring forms of this practice in Principle Decision No. 2026/347 dated 18 February 2026, published in the Official Gazette dated 24 March 2026, No. 33203.
The separation of notice and explicit consent was not introduced in 2026. Since 2018, the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform has required separate processes where processing relies on consent. Board Decision No. 2018/90 also distinguished acknowledgment that a notice was read from proof of consent. Principle Decision No. 2026/347 consolidates this approach into concrete rules for forms and screens and expressly connects noncompliance to Articles 12 and 18 of Law No. 6698 on the Protection of Personal Data.
II. Different Legal Functions of Notice and Explicit Consent
The notice obligation under Article 10 informs the data subject about the controller, processing purposes, transfers, the method and legal ground for collection, and the data subject’s rights. It applies whether processing relies on consent or another statutory condition. The controller must provide notice before processing begins, without waiting for a request or approval.
Explicit consent is one possible legal condition for processing; it is not a general permission that must be obtained for every activity. Valid explicit consent must relate to a specific matter, be informed and be freely given. It should therefore not be used as an umbrella declaration purporting to approve compulsory processing that the controller already performs under another legal ground.
Combining the concepts in one checkbox makes the declaration uncertain. Is the person confirming receipt of information or agreeing to an optional activity? Where unnecessary processing is tied to mandatory registration or contract acceptance, the freedom of the consent may also be questioned. A sound structure identifies the correct legal ground for each activity and reserves a separate affirmative choice for activities that genuinely depend on consent.
III. Effect of the Principle Decision on Forms and Digital Flows
Principle Decision No. 2026/347 requires the privacy notice and explicit-consent text to be prepared as separate texts under different headings where processing relies on consent. Both may appear on the same page or screen, but even when presented one after the other, each must have its own heading and a separate declaration mechanism. A single checkbox stating “I have read, understood and accept” does not establish that separation.
Where the processing relies on another condition under the Law, the data subject should not be presented with an additional consent text. Data required to establish or perform an order, for example, does not necessarily have the same legal basis as optional marketing communication. The required processing should be explained in the notice. If marketing genuinely relies on explicit consent, that purpose requires its own specific and optional declaration. Adding a consent checkbox to every collection point can obscure, rather than strengthen, the controller’s legal-basis analysis.
Any feedback requested in connection with a notice must also be labelled correctly. A controller may create a record that the notice was read and the information received, but it should not ask the data subject to “approve” the notice or “consent” to its explanations. Signature fields on paper and buttons or checkboxes in digital interfaces must reflect this distinction. Evidence that notice was provided and the affirmative declaration of consent should remain separate in both the visible user journey and the underlying records.
The Principle Decision also identifies unadapted use of another controller’s text as a risk. Wording must reflect the controller’s organisation, data categories, purposes, legal grounds and transfers. Vague statutory references, statements suggesting a transfer that does not occur, or a policy assumed to cover every activity do not provide an accurate activity-specific notice. Clarity and simplicity require legally necessary information to be limited to the relevant activity and expressed understandably.
IV. Records, Evidence and Compliance Architecture
The review of forms and screens should begin with the underlying data flow, not an isolated change to headings. A controller needs to identify the data collected at each point, the condition supporting each purpose, transfer recipients and purposes, and the relevant systems. Without that map, texts may look separate while remaining inconsistent with operations. Recruitment, customer service, marketing and product processes should not automatically be compressed into one general document.
Layered notices can be useful on mobile interfaces where essential information is visible at the first stage and more detail is readily accessible. Directing the user only to a general privacy policy, however, does not necessarily replace a notice tailored to the specific activity. The notice must be accessible at the point of collection, and the chosen link, pop-up, paper attachment or other method should not make the information difficult to reach.
The controller bears the burden of proving that notice was provided and that any explicit consent was validly obtained. The version of the text, the date and channel on which it was presented, and the scope of any consent should therefore be traceable through separate records. Digital systems should not collapse two legal events into one record merely because they share a timestamp. Paper processes should likewise distinguish a receipt or acknowledgment of notice from a consent declaration. Evidence should remain proportionate and should not generate unnecessary additional personal data.
Withdrawal of consent must also be reflected in operations rather than appearing only as a statement in the text. The withdrawal needs to reach the relevant system so that future processing based on that consent stops from the time the declaration is received. Processing supported by another legal ground or a statutory retention duty requires a separate assessment. Correct wording on the form will not achieve operational compliance if marketing platforms, customer-relationship systems, human-resources tools and service providers cannot implement the distinction.
V. Sector Applications and Foreign Companies
In e-commerce and digital services, account creation, order performance, payment, delivery and necessary security checks should not be bundled with optional marketing or profiling under one approval mechanism. Notice concerning required processing and an optional declaration for a consent-based purpose should be designed as different steps. Refusal to consent should not by itself prevent access to a core service that does not depend on that consent.
Loyalty programmes and retail forms often use a telephone number or membership identifier for several purposes, including discounts, account administration, analytics and commercial communication. A single broad consent obtained without assessing the legal ground for each purpose may weaken the requirement that consent be specific. The short customer-facing screen and the underlying customer-relationship and marketing systems should preserve the same purpose-level distinction.
In recruitment and employment processes, a signature confirming that a notice was read should not be compressed into the same declaration as consent requested from an employee or candidate. Health and patient processes require additional care because of the nature of the data, access requirements and the applicable processing conditions. Replicating a standard form across these contexts can conceal legally important differences between data categories and purposes.
For foreign groups operating in Turkey, a global or GDPR-oriented template may not be sufficient when translated without further analysis. The identity of the Turkish controller, local and intra-group data flows, the actual transfer structure, the KVKK processing condition used and the Turkish-language user journey should be assessed together. A conflict between group policy and the local form may affect both the accuracy of the notice and the scope of the consent. Treating the Turkish flow as a distinct legal and product requirement within the global system is more reliable than treating compliance as a translation exercise.
VI. General Assessment
The Board treats the requirements listed in Principle Decision No. 2026/347 as administrative and technical measures to be taken under Article 12(1) to ensure lawful processing of personal data. It also states that action may be taken under Article 18 where noncompliance is identified. The issue therefore extends beyond form design or drafting preference.
Displaying two headings is necessary where consent is used, but it is not sufficient on its own. Formal separation does not produce effective compliance if purposes, data categories and legal grounds are incorrectly mapped, user choices do not affect back-end systems, or withdrawal cannot be implemented. Legal, product, human-resources, marketing, information-technology and operations teams need to work from the same description of the data flow.
Following Principle Decision No. 2026/347, the priority is not to add new consent boxes to every existing form. It is to confirm which activities genuinely rely on explicit consent and to align the notice, affirmative choice, evidence record and system behaviour around that distinction.
