How to Draft a Privacy Notice Under Turkish KVKK

A privacy notice is one of the most fundamental obligations under the KVKK, ensuring the data controller informs the data subject about the scope of processing and their rights before processing begins.

Legal Basis for the Duty to Inform

Under Article 10 of KVKK No. 6698, the data controller or the person it authorises is obliged to inform data subjects on specified matters when personal data is collected. This obligation applies to all processing activities provided for by law, regardless of whether explicit consent will also be obtained.

Mandatory Elements a Privacy Notice Must Contain

A privacy notice must clearly state the identity of the data controller and its representative, if any; the purposes for which personal data will be processed; to whom and for what purpose the processed personal data may be transferred; the method and legal basis for collecting personal data; and how the rights listed in Article 11 of the KVKK (such as requesting information, rectification, erasure, and objection) can be exercised.

The Risk of Generic Notices

Privacy notices copied from the internet, or containing generic language that does not match the actual processing activity, may be considered a failure to genuinely fulfil the duty to inform. Board decisions emphasise that the notice must be specific to the data controller's actual practice and understandable — an important criterion.

Timing and Form of the Notice

The notice must be given at the moment personal data is collected, or at the latest before processing begins; it may be provided through different channels such as in writing, verbally, electronically, or via a call centre, but regardless of the channel used, the content must be complete.

Consequences of Failing to Comply With the Duty to Inform

Failing to fulfil the duty to inform is a violation subject to an administrative fine under Article 18 of the KVKK; moreover, explicit consent obtained following an incomplete notice may be considered invalid, potentially rendering the entire processing activity unlawful.

Practical Recommendations

Draft a separate privacy notice for each data processing activity (for example, employee, customer, and visitor notices) and use plain language, avoiding complex legal terminology. Review the notice regularly to check it remains consistent with your actual data processing practices.

This article is for informational purposes only and does not constitute legal advice. Please contact our team regarding your specific situation.