meta_id 2996141

On March 24, 2026, the Principle Decision Regarding the Requirement for Data Controllers to Prepare Separate Explicit Consent and Information Texts to Data Subjects issued by the Personal Data Protection Authority (PDPA) was published in the official gazette. Key points include: The PDPA has found that not presenting the consent form and the information text together to data subjects is a common violation, based on reports and complaints received. Consent forms must state that the data subjects explicitly consent to the processing of their personal data based on the purposes and legal grounds stated in the form. The burden of proof that explicit consent has been obtained rests with the data controller. In practice, data controllers shall: Present the explicit consent form and information text within a single document. Consent must be requested from the relevant individuals regarding the information provided. Use texts prepared by other data controllers without adapting them to their own operations. Use clear, understandable and simple language in privacy notices. Avoid the inclusion of general, ambiguous, incomplete, misleading and inaccurate information. Avoid the use of very detailed, complex and long texts.