Under Turkey's data protection law (KVKK), a privacy notice (aydınlatma metni) and explicit consent (açık rıza) are different tools. The notice fulfils a duty to inform that applies to every processing activity and needs no one's agreement. Explicit consent is a specific, informed and freely given approval that you need only when none of the law's other legal bases applies.
What goes wrong on real forms
On a typical Turkish contact form, job application page or dealer sign-up screen, one mandatory tick box sits above the submit button: "I have read the KVKK notice and give explicit consent to the processing of my personal data." The form will not send without it.
That design merges two separate things. A privacy notice is not a contract to be accepted; it is information you owe the person. And a mandatory consent box is not valid consent, because someone who cannot refuse without losing the service has not given it freely. The company collects consent it did not need and weakens the consent it does rely on.
The root cause is usually the system: a developer pastes legal text into the form, makes the box required and never stores which version was shown or when. The organisation's wider KVKK compliance programme may look complete, yet the database behind the forms cannot tell the two concepts apart.
Explicit consent vs privacy notice in Turkey: what each one is under KVKK
For readers outside Turkey: Law No. 6698 on the Protection of Personal Data, known as KVKK, is Turkey's counterpart to the GDPR, overseen by the Personal Data Protection Authority and its Board (KVKK — Law No. 6698, English text). The two concepts sit in different articles. Article 10 sets the duty to inform: when collecting data, the controller must state its identity, the purpose of processing, to whom and why the data may be transferred, the collection method and legal basis, and the person's rights under Article 11.
Explicit consent is just one of the processing conditions in Article 5. The second paragraph lists cases where processing is lawful without consent: it is expressly provided for by law, it is necessary to protect the life or physical integrity of the person or someone else where consent cannot be given, it is necessary for entering into or performing a contract, it is needed to meet a legal obligation, the person has made the data public, it is needed to establish or defend a right, or it serves the controller's legitimate interests without harming the person's fundamental rights. Because Article 5(1) is worded with consent as the general rule, consent is often requested even when another basis fits better. Yet if one of these bases applies, asking for consent is unnecessary and misleads the person into thinking processing will stop if they refuse.
Special category data (health, biometrics, criminal records and similar) is governed separately and more strictly by Article 6, which was amended by Law No. 7499 with the new rules in force since 1 June 2024. The same amendment turned consent into an exceptional route for transfers abroad; we cover that in our guide to KVKK cross-border data transfers.
| Criterion | Privacy notice | Explicit consent |
|---|---|---|
| Legal nature | Duty to inform (KVKK Art. 10) | One processing condition (KVKK Art. 5(1), Art. 6) |
| When required | Every time personal data is processed | Only when no other legal basis applies |
| Person's agreement | Not needed; no "I have read" box | Needed, through a clear affirmative act |
| Scope | All activities, purposes and transfers | One specific, defined matter |
| Can it be withdrawn? | Not applicable; the information has been given | Yes, at any time; processing stops from then on |
| Can it be a condition of service? | Yes, everyone receives it | No; refusing should not block the core service |
| Evidence | Which text was shown, through which channel | Who agreed, when, and to which text version |
The cost of mixing them up
According to the Personal Data Protection Authority's 2025 Annual Report, KVKK received 12,512 notices and complaints in 2025, of which 6,506 (52%) concerned unlawful processing. Unlawful processing usually means there was no valid legal basis, or the consent relied on turned out not to be valid.
In 2025, only 60 complaints to KVKK were filed specifically for failure to meet the duty to inform, whereas complaints about unsolicited SMS and calls reached 1,394 (11%). (KVKK 2025 Annual Report)
People are far less bothered by an imperfect notice than by processing they believe they never agreed to. The same report puts unlawful sharing with third parties second, at 2,838 complaints (22%), and a transfer that the notice never mentioned often lands in that category.
Fines are only part of the cost: a marketing list built on invalid consent must be cleaned up from scratch, processing must stop for data whose consent has been withdrawn, and if you cannot show which text a person agreed to, your position in a dispute is weak. Our advice is to treat consent as the basis of last resort and, wherever you do use it, to keep the evidence in the system.
Seven steps to build compliant forms
The same sequence works for web forms, apps, job applications and dealer portals.
- List the processing activities. For every form, record the fields collected, the purpose and the system the data goes to: CRM, HR, e-commerce, email marketing. This list feeds your organisation-wide personal data inventory.
- Match each purpose to a legal basis. Answering a quote request is pre-contractual; invoicing is a legal obligation; keeping a visitor log at the building entrance can often rest on legitimate interest. Keep explicit consent for purposes with no other match.
- Write notices per audience. Prepare separate, plain-language notices for customers, candidates, employees, visitors and suppliers. Each must cover every item Article 10 requires and be visible next to the form before any data is submitted.
- Separate the notice from any tick box. Replace "I have read" boxes with a clear link and a short summary. Keeping them apart is also conceptually right: informing is one act, consenting is a separate expression of will.
- Ask for consent per purpose, and make it optional. Use a separate, unticked box for each consent purpose. The form should still submit with the boxes empty, and the core service should carry on.
- Keep the evidence. Store the date, time, channel and text version of each consent. When the wording changes, keep the old version.
- Make withdrawal as easy as giving consent. Offer it in the account page and email footers. Withdrawal must stop processing in every connected system, not just one.
How long consent records and other data are kept is a separate decision, set by your data retention and disposal policy. If you must register with Turkey's data controllers' registry, reflect the same legal bases in your VERBİS registration.
Three situations that are often confused
Employee data. Asking new starters for consent is common, but payroll, social security filings and occupational health records rest on legal obligations, and the imbalance of power in employment makes it hard to show that an employee's consent was freely given. We map which employee data rests on which basis in our guide to employee personal data under KVKK. The Board's position on fingerprint time tracking is a concrete example; see our article on biometric attendance and data protection.
Marketing messages. Sending promotions by SMS, email or phone is governed, separately from KVKK, by Turkey's E-Commerce Law No. 6563, which as a rule requires prior consent to commercial electronic messages and the recording of those consents in the national Message Management System (İYS); exceptions, such as messages sent to tradespeople and merchants, need separate assessment. KVKK consent does not replace that approval, and that approval does not replace the KVKK notice. We explain why these permissions should be stored per channel in our guide to the customer data platform (CDP).
Security cameras and chat channels. Security CCTV is usually based on legitimate interest or a legal obligation rather than consent, with the notice given through a sign at the entrance and a full text (CCTV recording and KVKK). The same distinction applies when you deploy a WhatsApp Business chatbot: answering an order query and sending a campaign rest on different bases.
How we handle this at Digital Bridge
Consent and privacy notices are as much a software problem as a legal one, and we tackle both in one team. Our data protection compliance consultancy starts with a gap analysis: we review your forms, contracts and the systems the data flows through, then map each purpose to its legal basis in a single table.
Then we build the text into your systems. For custom web software and existing portals we develop versioned notices, per-purpose consent records, a withdrawal flow and an evidence report. Consent status is fed from one source into your CRM system, your B2B e-commerce site and your email sending tool, so a withdrawn permission cannot linger in one system while being processed in another.
On the employee side, we reorganise onboarding documents in your HR, payroll and personnel management processes around the correct legal bases. For the notice itself and signed onboarding documents, our own SmartFiles document management is a good fit: each text uploaded under the same name is kept as a new version showing who uploaded it and when, the final version can be sent for sequential approval, and a document under a legal hold cannot be deleted. We usually pilot with one or two of your busiest forms, confirm the flow works, then roll it out to the remaining channels.
Consent records are personal data too, so security matters; our SME cyber security checklist helps check your overall position. If you use AI-assisted customer tools, our guide to AI and KVKK covers the legal basis questions, and every related article is collected on our Cyber Security and Compliance guides page.
Next step: review your forms with us
The quickest start is to put your three busiest data-collecting forms and your employee onboarding pack into one table: which field, which purpose, which legal basis, whether consent is needed, and where the evidence lives. It usually reveals unnecessary consents and notice gaps at first glance.
To build that table together and turn the wording into working systems, get in touch through our contact page or call +90 552 380 25 25. After a needs analysis we prepare a written proposal setting out the scope, phases and fee.