Privacy Notices

One of the basic obligations in personal data protection law is to inform the people whose personal data is processed in an accurate and understandable way. Under the Law on the Protection of Personal Data No. 6698 (KVKK), this obligation is regulated as the “duty to inform” (aydınlatma yükümlülüğü).

Privacy notices (aydınlatma metinleri) are prepared to tell data subjects for what purposes their personal data is processed, on which legal basis it is processed, with whom it may be shared and what rights the persons concerned have.

The privacy notices used by companies, institutions and digital service providers should not be seen as just a standard document. These texts must be prepared in line with the business’s actual data processing activities.

What Is a Privacy Notice?

A privacy notice is a legal text prepared by the data controller (veri sorumlusu) that processes personal data in order to inform the person concerned about its data processing activities.

Under the KVKK, people must be given information on certain matters when their personal data is collected. Through this information, people can learn for what purposes their data is used and what rights they have.

A privacy notice is not a consent form. Its main purpose is to create the transparency that allows data subjects to exercise their right of control over their personal data.

Why Is the Duty to Inform Important?

The principle of transparency is very important when personal data is processed. People have the right to know for what purposes information about them is used.

Failing to fulfil the duty to inform may create legal risks for data controllers under the KVKK. In addition, incomplete or inaccurate texts may lead to the business’s data processing processes being questioned.

What Information Should a Privacy Notice Contain?

For a privacy notice to be legally sufficient, it must explain the basic elements of the personal data processing.

In general, the text should include the identity of the data controller, the purposes for which personal data is processed, the categories of data processed, the persons or institutions to which the data may be transferred, the method of collecting the data and its legal basis, and the rights of the person concerned.

However, since every business has different data processing activities, using the same text for all organisations is not the right approach.

Privacy Notice for Websites

Data collection through websites is also assessed under the KVKK. Contact forms, membership systems, quote requests, newsletter sign-ups and analytics tools may involve personal data processing.

For this reason, the privacy notices used on websites must be prepared to match how the site actually works.

For example, the data processing activities of an e-commerce site and of a corporate website that has only a contact form are not the same. The privacy notices to be used must therefore also be different.

Privacy Notices for Employees

Employers process a large amount of personal data about their employees in the course of the employment relationship. Identity details, salary information, performance records, leave records and health data may all be part of employee data.

Privacy notices prepared for employees should clearly state which data is processed for which purposes and how employees can exercise their rights.

Privacy Notices for Customer and User Data

Personal data processing also arises in the relationships companies have with their customers or users.

The persons concerned must be informed about the data collected during sales transactions, membership systems, support services and marketing activities.

Data analysis carried out to improve the customer experience, advertising activities and communication processes should also be assessed carefully from a KVKK perspective.

Privacy Notice for CCTV Recordings

Workplaces, shops, apartment buildings and various businesses may use camera systems for security purposes.

Since camera recordings qualify as personal data, people must be properly informed about them.

In the information process for camera use, the purpose of the recordings, the retention period, the data controller’s details and the rights of the persons concerned should be stated clearly.

The Difference Between a Privacy Notice and Explicit Consent

The privacy notice and explicit consent (açık rıza) are two different KVKK processes that are often confused in practice.

A privacy notice fulfils the obligation to give information to the person. Explicit consent, on the other hand, is the person’s permission, given of their own free will, for certain data processing activities.

Informing a person does not always mean that explicit consent has been obtained. Likewise, obtaining explicit consent does not remove the duty to inform.

Risks of Incorrectly Prepared Privacy Notices

Using ready-made texts from the internet without changes, or preparing documents that do not reflect the business’s real processes, may not provide sufficient legal protection.

Privacy notices should be seen not only as a legal requirement but as part of the company’s data management system.

The Role of Privacy Notices in the KVKK Compliance Process

Privacy notices are one of the important parts of a comprehensive KVKK compliance process. However, they are not sufficient on their own.

They should be assessed together with the business’s data inventory, retention policies, access rights, data security measures and other legal processes.

Transparency in Corporate Data Management

Transparency is one of the basic elements of trust in personal data protection law. When people know how their data is used, both legal certainty and trust in organisations increase.

Correctly prepared privacy notices help businesses meet their KVKK obligations and, at the same time, contribute to building a sustainable data management framework.