Information text and explicit consent are the two most frequently confused concepts in KVKK application. Misuse leads to both legal risk and high administrative fines.
Disclosure Obligation (KVKK article 10)
When collecting personal data, the data controller shall always inform the data subject:
- Identity of the data controller
- Purposes for which personal data will be processed
- Purpose of transfer and persons to be transferred
- Data collection method and legal reason
- Rights of the person concerned (Art. 11)
It provides clarification with informative text. Thisis always necessary; It is not subject to consent.
Explicit Consent (KVKK art.3, art.5/1)
Explicit consent is consent regarding a specific subject, based on information and expressed with free will. Only used absent other legal reasons:
- Not expressly provided for in the law
- Establishment or execution of the contract
- Legal obligation
- Other KVKK Article 5/2 clauses other than express consent
- Legitimate interest
Most Common Mistakes
- Requesting explicit consent for transactions that are already mandatory by contract
- Presenting explicit consent as a "condition" compared to other services
- Combining disclosure with explicit consent (there must be separate written documents)
- Vague consents such as "Consent to the processing of all data"
Important Decisions of the KVKK Board
In many decisions, the KVKK Board has emphasized that binding explicit consent to the condition of "if not given, the service will not be provided" invalidates the express consent, and in this case, clarification should be provided and another legal reason should be sought.
The Board considered the "single box" combined consent (KVKK + commercial message consent + membership consent) as "mixed consent" and deemed it invalid. Each one must be purchased in a separate box.
Practical Tips
- Write your information text in clear and simple language
- Receive explicit consent in a separate box only for mandatory data
- Separate marketing authorization for marketing purposes (also in the Electronic Commerce Law No. 6563)
- Additional care for children (under 16 years old)
Improperly established disclosure/consent processes may lead to high administrative fines. Get consultancy for KVKK compliance project.