How to Obtain Valid Explicit Consent Under Turkish KVKK

Explicit consent is one of the legal bases provided by law for processing personal data — one relied on only when no other legal basis applies, and one requiring a genuinely free declaration of will, not a mere formality.

Definition and Elements of Explicit Consent

Under Article 3 of KVKK No. 6698, explicit consent is consent relating to a specific matter, based on being informed, and freely given. Three elements follow from this definition: the consent must relate to a specific processing activity, the data subject must have been informed in advance about the scope of the processing, and the consent must be given free of any pressure.

The Prohibition on "Blanket" Consent

Consent statements containing general and vague language, such as "Do you agree to the processing of your personal data?", are characterised in Board decisions as "blanket consent" and considered invalid. Consent must be obtained separately and clearly for each processing purpose.

Consent Must Be Informed

For explicit consent to be valid, the data subject must have been informed in advance, through a privacy notice, of the purpose, scope and consequences of the processing. Consent obtained without such disclosure is invalid because it fails to meet the requirement of being informed.

Consent Cannot Be Made a Condition for Providing a Service

Providing a service cannot be made conditional on consent to a data processing activity that is not necessary for the performance of the contract; otherwise, the consent cannot be said to have been given freely.

Withdrawing Consent

The data subject may withdraw their explicit consent at any time; any data processing carried out after withdrawal becomes unlawful. The data controller is obliged to make withdrawing consent at least as easy as giving it.

Cases Where Explicit Consent Is Not Required

In the cases listed in Article 5/2 of the KVKK (such as being expressly provided for by law, being necessary for the establishment or performance of a contract, the data controller's legal obligation, or legitimate interest), data may be processed without seeking explicit consent; in these cases, identifying the correct legal basis rather than seeking consent avoids unnecessary consent requests.

Practical Recommendations

Design your consent forms with separate checkboxes for each processing purpose and avoid using pre-ticked boxes; clearly inform the data subject of the channel through which consent can be withdrawn.

This article is for informational purposes only and does not constitute legal advice. Please contact our team regarding your specific situation.