meta_id 2997844

On March 24, 2026, Turkey's Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) published a public announcement regarding Principle Decision 2026/347 dated February 18, 2026. The decision addresses requirements for data controllers to prepare consent texts and information notices as separate, distinct documents. The authority identified that presenting consent and information notices in a combined or intermingled format represents one of the most frequently encountered violations in complaints and reports received by the institution. The decision establishes that data controllers must prepare these texts separately when personal data processing is based on explicit consent under the Personal Data Protection Law (Law No. 6698). Key requirements include: information notices must be provided before processing begins, regardless of whether explicit consent is required; when both documents appear on the same page, they must use different headings and appear as separate statements; information notices must use clear, understandable, and simple language; and texts must not be generic, ambiguous, incomplete, misleading, or contain false information. Data controllers must customise texts to their specific operations rather than copying templates from other organisations verbatim. When personal data processing relies on legal bases other than explicit consent, only the information notice obligation applies, and no separate consent text should be presented to data subjects. The authority emphasised that compliance with these requirements constitutes an administrative and technical safeguard under Article 12 of the Personal Data Protection Law. Non-compliance will result in enforcement action under Article 18 of the law.