When Is Explicit Consent Not Required Under KVKK?

⏱️ Reading time: 8 min · 📁 Category: KVKK & Digital Compliance

When Is Explicit Consent Not Required Under KVKK?

The processing of personal data under the Law on the Protection of Personal Data No. 6698 (KVKK) is, as a rule, based on the explicit consent of the person concerned.
However, in some cases, the Law allows personal data to be processed without explicit consent.

This article clearly and systematically explains the situations in which explicit consent is not required under KVKK.

📌 What is explicit consent? A brief reminder

Explicit consent is consent that is:

• Specific to a particular matter,
• Informed,
• Freely given.

Under KVKK, explicit consent is not an exceptional basis, but a complementary legal basis.
Explicit consent is not needed if one of the processing conditions listed in the law applies.

⚖️ Cases in which explicit consent is not required under KVKK

Article 5(2) of KVKK provides an exhaustive list of cases in which personal data may be processed without explicit consent.

1️⃣ Express provision in law

If another law expressly provides for personal data processing, the person’s explicit consent is not required.

• Billing information under tax legislation
• SGK notifications under the Labour Law
• Criminal records under criminal legislation

In these cases, data processing is the fulfillment of legal obligation.

2️⃣ Consent cannot be obtained because of factual impossibility

Explicit consent is not required when the person cannot express consent because of factual impossibility and processing is necessary to protect the life or physical integrity of:

• The person concerned, or
• Another person.

In those circumstances, explicit consent is not required.

Example: Processing an unconscious person’s health information for emergency treatment. 3️⃣ Direct connection with the conclusion or performance of a contract

Explicit consent is not required for processing directly necessary to conclude or perform a contract to which the person is a party.

• Address and contact information on e-commerce orders
• Recipient details for parcel delivery
• User information on subscription services

Critical criterion: The processing must be directly necessary for the contract.

4️⃣ Fulfillment of Legal Obligation

Explicit consent is not needed when processing is necessary for the controller to fulfil a legal obligation.

• Maintaining employee personnel files
• Responding to requests from public authorities
• Audit and reporting obligations

5️⃣ Personal data made public by the person concerned

If the person concerned has made his or her personal data public, this data may be processed without explicit consent.
The processing purpose must, however, be consistent with the purpose for which the data was made public.

6️⃣ Establishing, exercising or protecting a right

• Lawsuits and enforcement proceedings
• Presenting evidence in legal disputes
• Debt collection processes

This provision is particularly important in legal, finance and human resources processes.

7️⃣ Data Processing under legitimate interest

If processing is necessary for the controller’s legitimate interests and does not harm the person’s fundamental rights and freedoms,
explicit consent is not required.

Example: Proportionate workplace security cameras about which people have been informed. ⚠️ The most common mistake: collecting unnecessary explicit consent

Obtaining explicit consent when a legal basis already exists can lead to invalid consent,
non-compliance risks and administrative fines.

✅ Conclusion: explicit consent is a fallback legal basis

• It is not the first option to use.
• It applies when no other legal grounds exist.
• Incorrect implementation creates serious risks.

For each data processing activity, the legal processing conditions must be analyzed first,
and explicit consent should be obtained when it is truly required.

Request a KVKK compliance analysis