Explicit Consent or a Privacy Notice? A Common KVKK Confusion

⏱️ Reading time: 8 min · 📁 Category: KVKK & Digital Compliance

Explicit Consent or a Privacy Notice? A Common KVKK Confusion

Explicit consent and the duty to inform are two fundamental concepts most often confused under KVKK.
Many companies believe explicit consent is required for every data processing activity. Yet this approach is unnecessary
and can also lead to a KVKK violation if applied incorrectly.

The fundamental distinction is clear: the duty to inform is mandatory, while explicit consent is an exceptional legal basis.
The duty to inform must therefore be fulfilled in every case; explicit consent should be obtained only where necessary.

Short answer: The duty to inform requires the data subject to be informed and must always be fulfilled.
Explicit consent is obtained only when no other legal conditions for processing apply. What is the duty to inform?

The duty to inform requires the data controller to inform the data subject when processing personal data.
It is a fundamental KVKK principle and ensures transparency in data processing.

The following information must be provided:

• The identity of the data controller
• For what purpose personal data will be processed
• To whom data can be transferred
• Data collection method and legal basis
• Rights of the data subject

This information is usually provided in a privacy notice, which must be presented before processing begins.

What is explicit consent?

Explicit consent is the data subject’s freely given, informed agreement to a specific matter.
In the KVKK, explicit consent is only one of the legal grounds for processing personal data.

The important point, however, is that explicit consent is not always necessary.
If there is another legal reason for data processing, explicit consent should not be obtained.

B10’s view: Obtaining unnecessary explicit consent also violates KVKK.
This is because the legal basis for processing has been established incorrectly. When is explicit consent required?

Explicit consent applies when no other legal conditions for processing are met.

For example:

• Marketing and advertising activities
• Profiling and analysis
• Use of non-essential cookies
• Data processing activities that are not explicitly regulated in law

When is explicit consent not required?

Under KVKK, data may be processed without explicit consent in the following cases:

• Processing expressly provided for by law
• Formation or performance of a contract
• Fulfillment of legal obligation
• Establishment, exercise or protection of a right
• Legitimate interest (in certain circumstances)

In these cases, processing should rely on the appropriate legal basis rather than explicit consent.

What is the main difference between the duty to inform and explicit consent?

Privacy information and explicit consent are often presented together, but they are different things.

Duty to inform

• Mandatory
• For informational purposes
• Applies to every data processing activity

Explicit consent

• Not always mandatory
• A process for obtaining agreement
• Used in certain situations

Practical fact: Explicit consent obtained without providing the required information is invalid. Most frequent mistakes Obtaining explicit consent for every processing activity

This approach harms the user experience and is legally incorrect.

Failing to provide a privacy notice

Even if explicit consent is obtained, failure to provide the required information violates KVKK.

Making explicit consent mandatory

Telling users “you cannot receive the service unless you accept” invalidates consent.

Combining everything in one document

Privacy notices and explicit-consent texts must be separate.

How should KVKK compliance processes be structured?

The correct approach proceeds in this order:

1. The purpose of data processing is determined
2. The legal basis is chosen
3. Provide the required information
4. Obtain explicit consent if necessary

The B10 approach: not explicit consent, but the correct legal ground

At B10 Digital Agency, the issue we encounter most often in KVKK processes is
companies trying to collect unnecessary explicit consent.
The correct approach is to analyse each processing activity separately and
establish the appropriate legal basis.

Explicit consent is not a safeguard; it is a tool that creates risk when misused.

Conclusion

The duty to inform and explicit consent are different concepts under KVKK.
The duty to inform must always be fulfilled; explicit consent should be obtained only when necessary.

If this distinction is not made correctly, companies may unknowingly violate the KVKK.

Let’s structure your KVKK processes correctly