When is explicit consent required under KVKK (Türkiye's Personal Data Protection Law)? It's one of the questions we hear most often from companies. Most companies' reflex is to add a checkbox anywhere they aren't sure. But explicit consent is only one of the conditions under which the Law allows personal data to be processed, and it is often not the most appropriate one. Asking for consent in the wrong place has unexpected consequences, such as the work having to stop when someone withdraws their consent. In this article we look in plain language at when explicit consent is truly needed and at the other legal grounds.
What explicit consent is, and what it isn't
As defined in the Law, explicit consent is consent that relates to a specific matter, is based on information and is given freely. Let's translate these three conditions into everyday language:
- A specific matter: A general approval like "I consent to all my data being processed for any purpose" is not valid. Consent is obtained for a clearly defined processing activity.
- Based on information: The person must know what they are agreeing to. That's why the privacy notice comes before consent.
- Freely given: The person must have a real option to say "no," and must not be penalized for saying it.
Explicit consent can be withdrawn at any time. So any processing you base on consent must stop the moment the person withdraws it.
Legal grounds other than explicit consent
The Law also lists situations in which personal data may be processed without explicit consent. For a website or business application, the most common ones are:
| Legal ground | Typical example on the web and in software |
|---|---|
| Entering into or performing a contract | Collecting an address to ship a product to the person who ordered it |
| Legal obligation | Keeping invoice details as required by tax legislation |
| Expressly provided for by law | Legislation requiring certain records to be kept |
| Establishing, exercising or protecting a right | Keeping transaction records in case of a dispute |
| Legitimate interest (provided it doesn't harm fundamental rights) | Keeping server logs for site security |
| Made public by the data subject | Business contact details a person shared publicly, limited to the purpose of sharing |
For example, you don't need explicit consent to reply to a request sent through a contact form; the person filled in the form for exactly that purpose. Sending the same person a monthly campaign newsletter, however, is a separate purpose and does require consent. For commercial electronic messages, the rules of İYS (Türkiye's commercial message consent registry) also apply; we explained this in our article on email marketing.
Don't make consent a condition of service
There is a principle the Personal Data Protection Board has stressed repeatedly in its decisions and guidelines: a product or service should not be made conditional on consent to data processing that isn't necessary for that service. Typical examples we see in the field:
- A sign-up form that can't be completed without ticking "I agree to receive marketing messages"
- Requiring a phone number and advertising consent to download a catalog
- Not showing the site at all to visitors who reject cookies
In setups like these, consent loses its "freely given" condition. The fix is simple: use the correct legal ground for the necessary processing, and leave the optional processing to a separate box that starts unticked. For details on the cookie side, see our article on how to obtain cookie consent.
Special categories of data need extra care
Data such as health, biometrics, religion and criminal convictions are protected separately under the Law as special categories of personal data. The amendment made by Law No. 7499, which took effect in 2024, expanded the processing conditions other than explicit consent for special categories of data as well. Even so, the boundaries for this data are narrower and additional security measures are expected. Companies that keep clinical, laboratory or employee health records must address this area together with their legal counsel. You'll find healthcare-specific topics in our digital guide for clinics.
Four questions for choosing the right legal ground
- Can I provide the service the person wants without processing this data? If not, the contract ground is most likely appropriate.
- Does a regulation require me to keep this record? If so, legal obligation is appropriate.
- Is the processing outside what the person would expect, or does it serve an additional purpose (promotion, profiling)? If so, consent comes into play.
- If the person withdraws consent, can I continue the work? If I'm obliged to continue anyway, consent is not the right ground in the first place.
How we do it at Globya
When we design a form, a sign-up flow or custom software, we keep a small table that lists the purpose and legal ground next to every data field. Optional consents come as separate, unticked boxes; consent records are stored with a timestamp and the text version, and when consent is withdrawn, the system automatically stops the related processing. The final word on the legal assessment belongs to your legal counsel; we set up the technical side accordingly. KVKK requirements are never left out of our projects, and there is no extra charge.
Frequently asked questions
Does putting an explicit consent box on a contact form do any harm?
It may not cause direct harm, but it sends the wrong message. If the person withdraws consent, you'd be in a position where you can't respond to their request. Responding to a request generally doesn't require consent; a privacy notice is enough. Confirm your own situation with your legal counsel.
What do we need in order to send campaign emails to our customers?
Promotional commercial electronic messages require the recipient's prior approval, and these approvals are expected to be registered in İYS. This is a separate regulation from explicit consent under KVKK; you need a flow that satisfies both.
How do we prove consent?
You should keep a record of when consent was given, with which text and through which channel. A database field that just says "yes" may not be enough; the text version and timestamp matter.
Who can review our existing forms?
We can review your forms and sign-up flow from a technical standpoint and hand your legal counsel a ready-made table. You can reach us at +90 850 432 55 13 or through the contact page.
The Globya assistant is online 24/7; it answers right away and passes your question to the team if needed.