Veri Sorumluları Tarafından Açık Rıza ve Aydınlatma Metinlerinin Ayrı Ayrı Düzenlenmesi Gerektiği Hakkında Kişisel Verileri Koruma Kurulunun 18.02.2026 Tarihli Ve 2026/347 Sayılı İlke Kararına İlişkin Kamuoyu Duyurusu | Kişisel Verileri Koruma Kurumu

https://www.kvkk.gov.tr/Icerik/8710/veri-sorumlulari-tarafindan-acik-riza-ve-aydinlatma-metinlerinin-ayri-ayri-duzenlenmesi-gerektigi-hakkinda-kisisel-verileri-koruma-kurulunun-18-02-2026-tarihli-ve-2026-347-sayili-ilke-kararina-iliskin-kamuoyu-duyurusu
Success
Service Third-Party Providers 25% Payment Processors 20%
Specialism Data Protection 92% Supervision 78%
2026-03-26 09:06:50 · arahman@vixio.com
ID
2997844
GUID
277bb4b70bbae861c33665a46da91f23

Classification

Service
Third-Party Providers (25%)

This update concerns data protection formatting requirements for consent and information notices, which is administrative and procedural in nature rather than directly regulating payment services or products.

Payment Processors (20%)

While data protection may tangentially apply to third-party payment service providers handling personal data, this update is generic data protection guidance unrelated to payments-specific operations or compliance.

Specialism
Data Protection (92%)

The update establishes mandatory formatting and content requirements for consent and information notices in personal data processing, which directly addresses data subject privacy rights and GDPR-equivalent protections under Turkish law.

Supervision (78%)

The authority emphasizes compliance as an administrative and technical safeguard with enforcement action threatened for non-compliance, indicating a supervisory oversight component requiring human review given the enforcement context.

Pipeline Progress

🔄 Pipeline Journey

Queued 08:56:20
+600s
Metadata 09:06:20
+0s
S3 Content 09:06:20
+0s
Extracted 09:06:20
+8s
LLM Gen 09:06:28
+22s
Stored 09:06:50
TITLE: Turkey's Personal Data Protection Authority Issues Guidance on Separate Consent and Information Notice Formatting BODY: On March 24, 2026, Turkey's Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) published a public announcement regarding Principle Decision 2026/347 dated February 18, 2026. The decision addresses requirements for data controllers to prepare consent texts and information notices as separate, distinct documents. The authority identified that presenting consent and information notices in a combined or intermingled format represents one of the most frequently encountered violations in complaints and reports received by the institution. The decision establishes that data controllers must prepare these texts separately when personal data processing is based on explicit consent under the Personal Data Protection Law (Law No. 6698). Key requirements include: information notices must be provided before processing begins, regardless of whether explicit consent is required; when both documents appear on the same page, they must use different headings and appear as separate statements; information notices must use clear, understandable, and simple language; and texts must not be generic, ambiguous, incomplete, misleading, or contain false information. Data controllers must customise texts to their specific operations rather than copying templates from other organisations verbatim. When personal data processing relies on legal bases other than explicit consent, only the information notice obligation applies, and no separate consent text should be presented to data subjects. The authority emphasised that compliance with these requirements constitutes an administrative and technical safeguard under Article 12 of the Personal Data Protection Law. Non-compliance will result in enforcement action under Article 18 of the law.
  • Scraped:2026-03-26 09:06:50
  • Created:2026-03-26 09:06:50
  • By:arahman@vixio.com (35)