What Is a Privacy Notice?
A privacy notice explains to an individual who processes their personal data, for which purposes, on what legal basis, how the data are collected and to whom they may be transferred.
The notice must match the actual processing activity. Job applications, customer transactions and any use of cookies may therefore require different information. A standard website page does not replace that assessment.
The obligation to inform is one of the fundamental obligations of the data controller. This obligation does not depend on the explicit consent of the person concerned. Even in cases where explicit consent is obtained, the person concerned must be informed separately.
When is a Privacy Notice Mandatory?
As a rule, the obligation to inform arises in every case where personal data is processed. Personal data means any information regarding an identified or identifiable natural person. Name, surname, telephone number, e-mail address, IP address, camera recording, CV, health information, location information or customer transaction information may be included in this scope.
Information should generally be provided when data are collected. Where data are obtained indirectly, the Turkish Communiqué on the Obligation to Inform requires information within a reasonable period, by the first contact if used for communication, or by the first transfer if a transfer is planned.
What Information Should Be Included in the Privacy Notice?
The privacy notice should include at least the following information:
- Identity of the data controller and his representative, if any,
- For what purposes personal data will be processed,
- To whom and for what purposes the processed data can be transferred,
- Method of collecting personal data,
- Legal reason for data processing,
- Rights of the relevant person under Turkish Personal Data Protection Law No. 6698.
The information should be specific, clear and understandable. Purposes and legal bases must relate to the actual processing activity; vague statements and identical wording for every activity may be insufficient.
Are Privacy Notice and Explicit Consent the Same Thing?
A privacy notice and explicit consent serve different functions. The notice provides information; explicit consent is a freely given and informed statement concerning a specific processing activity.
Not all processing requires explicit consent. Another statutory processing condition may apply. The obligation to inform nevertheless remains.
Where explicit consent is sought, it must be distinguished from the notice and relate to a specified processing activity. Providing information must not be presented as obtaining blanket consent.
Is Publishing a Privacy Notice on the Website Enough?
Publishing a general privacy notice on the website may not be sufficient on its own in most cases. Because the purpose, legal basis, data category and transfer recipient of each data processing activity may be different.
Contact forms, recruitment, cookies, newsletters and appointment tools can involve different processing activities. Information must reflect the functions actually used.
The notice must be accessible to the individual at the appropriate time. A hard-to-find footer link may not be sufficient.
Risk of Proof for the Data Controller
The controller must be able to demonstrate compliance with the obligation to inform, including which version was provided, when and by what means.
Depending on the activity, version records, timestamps, suitable logs or documented notices may support proof. An acknowledgement of receipt is distinct from consent, and no single mechanism is appropriate for every activity.
Common Mistakes in Practice
Typical problems include:
- Using the same general text for each data processing activity,
- Failure to clearly state the legal basis,
- Unclear recipients or categories of recipients,
- Combining information provision with explicit consent,
- The processing purposes are written in very broad and future-oriented vague expressions,
- Presenting the text to the relevant person after the data is obtained,
- No evidence that the information was provided.
These errors may result in administrative sanctions, complaints, data security investigations and reputational risks.
Frequently Asked Questions
Does every business need a privacy notice?
As a rule, the obligation to inform comes into question for natural or legal persons who process personal data. The scale of the business, the nature of the data processing activity and the title of data controller should be evaluated in the individual case.
Is a privacy notice still required when explicit consent is obtained?
Yes. Even if there is explicit consent, the obligation to inform must be fulfilled separately.
Is publication on the website sufficient?
Not always. Information must match the activity and be provided accessibly and at the appropriate time.
Must the legal basis be stated?
Yes. It should be clearly stated on which legal basis under Turkish Personal Data Protection Law No. 6698 the data processing is based.
Who proves that he has fulfilled his obligation to inform?
The controller must be able to demonstrate that the required information was provided.