Services

Explicit Consent

KVKK and Data Protection

Explicit consent (açık rıza) is one of the most important legal concepts in the processing of personal data. In practice, however, explicit consent is often treated as nothing more than a tick box or a signature. Yet under the Law on the Protection of Personal Data No. 6698 (KVKK), valid explicit consent is a special legal basis for data processing that must meet certain legal conditions.

Explicit consent processes are a comprehensive legal process that covers determining the purposes for which personal data is processed, informing the data subject adequately and obtaining consent that is given freely.

It is very important for companies, institutions and digital platforms to identify correctly the situations that require explicit consent when processing personal data, both to protect the rights of data subjects and to reduce the legal risks of data controllers.

Under Law No. 6698, explicit consent means consent relating to a specific matter, based on information and given freely.

The three basic elements in this definition are important for valid explicit consent to exist. The person must know which data processing activity they are permitting, must make their decision without pressure, and the consent must be limited to a specific matter.

In KVKK practice, the processing of personal data is not always subject to explicit consent. Where one of the other legal grounds for processing set out in the law exists, it may not be necessary to obtain explicit consent as well.

For example, certain data processing activities that are necessary for the establishment or performance of a contract may be assessed under the grounds set out in the law.

Businesses must therefore first determine the legal ground on which they process data. Obtaining explicit consent unnecessarily, or failing to obtain it where it is required, can cause legal problems.

For explicit consent to be legally valid, the person must be in a position to understand what they are agreeing to.

Consents that contain general and vague wording, that do not explain which data will be used for what purpose, or that are presented as a mandatory condition of the service may become legally questionable.

Explicit consent texts should clearly set out the purpose of processing, the types of data to be used and the person’s right to choose.

One of the issues most often confused in KVKK practice is the difference between explicit consent and the duty to inform (aydınlatma yükümlülüğü).

A privacy notice (aydınlatma metni) aims to inform the data subject about the processing of their personal data. Explicit consent, on the other hand, is the person’s permission for a specific data processing activity.

In other words, informing is a duty to provide information, whereas explicit consent is a declaration of will that, in certain cases, forms the legal basis for a data processing activity.

How Should an Explicit Consent Text Be Prepared?

Explicit consent texts should be prepared according to the business’s actual data processing activities. Using the same standard text for every company or website does not always provide sufficient legal protection.

The explicit consent process should clearly set out which data will be processed, for what purposes it will be used, whether the data will be transferred and how the person can exercise their right to choose.

Particularly for e-commerce sites, healthcare institutions, educational institutions and businesses processing employee data, explicit consent processes need to be designed to suit the field of activity.

When obtaining explicit consent, the person’s free will must be protected. Making the use of a service unnecessarily conditional on explicit consent, or limiting the person’s options, may cause problems for the validity of the consent.

In addition, since the burden of proving explicit consent lies with the data controller, it is important to record when and under what conditions the consent was obtained.

Today, explicit consent is mostly obtained through digital platforms. Approvals given electronically by users on websites, mobile applications and online services can be valid under certain conditions.

However, for consent obtained electronically as well, the user must have been informed, must be able to make their choice freely, and the approval given must be provable.

A person has the right to withdraw explicit consent that they have previously given. Withdrawal of consent may remove the legal basis for processing the personal data.

Data controllers should therefore establish not only procedures for obtaining consent but also the procedures to be applied when consent is withdrawn.

Health information, biometric data, genetic data and similar special category personal data (özel nitelikli kişisel veri) are groups of data that require a higher level of protection.

When processing such data, it must be carefully assessed which legal grounds exist. Special category data processes can carry significant legal risks, particularly in the healthcare, human resources and insurance sectors.

In corporate structures, explicit consent processes are not completed simply by preparing a document. It is necessary to analyse in which processes the data of employees, customers and users is processed.

Identifying data collection points, reviewing the forms used, checking digital systems and keeping consent records in an orderly way are parts of an effective KVKK compliance process.

Setting up correct explicit consent processes in personal data processing activities is important not only to avoid administrative sanctions but also to secure individuals’ right of control over their data.

For businesses, establishing transparent and sustainable data processing processes suited to their own activities is one of the basic elements that strengthen both legal compliance and user trust.

Back to Services