KVKK: why the privacy notice and explicit consent are separate documents

This article is general information, not legal advice. Work with your legal adviser on your own processes.

Two separate obligations

The privacy notice is the controller's duty to inform: which data is processed, for what purpose, on what legal basis, to whom it is transferred and what rights apply. Explicit consent is approval on a specific matter, based on information and freely given. One does not replace the other.

Common mistakes

• Tying the privacy notice to an “I have read and accept” box.
• Burying explicit consent inside the privacy notice.
• Collecting marketing consent with a pre-ticked box.
• Making a service conditional on consent it doesn't need.

In practice

On forms the privacy notice is offered as a link; a separate, unticked box is used only for processing that truly relies on consent (marketing messages, for example). Supplier and visitor portals also show the notice at sign-in.