KVKK Series 2/5: Processing Conditions and Explicit Consent

Requesting explicit consent for every operation is a common mistake in KVKK practice. Consent is one processing condition; employers must also assess the imbalance in their relationship with employees. This article considers Article 5, valid consent, the Board’s 2026 principle decision and the 2024 amendment to Article 6.

1. Processing conditions

Article 5 allows processing with explicit consent or, without it, when one of its other conditions applies:

• Express statutory provision: for example, required employment records.
• Contract: necessary processing directly related to forming or performing a contract, such as an address required for delivery. Not every requested detail is necessary simply because a contract exists.
• Legal obligation: necessary processing for invoicing, tax or social security duties.
• Establishment, exercise or protection of a right: necessary records for legal claims, with justified retention rather than indefinite storage.
• Legitimate interests: necessity for a controller’s legitimate interests, provided the individual’s fundamental rights and freedoms are not violated. Fraud prevention requires an actual balancing assessment.
• Life or bodily integrity: necessity to protect the person or another when consent cannot be expressed because of actual impossibility or is not legally valid.
• Made public by the individual: assess the person’s disclosure and its purpose; public accessibility alone does not permit any reuse.
• Explicit consent: evaluate it where another applicable condition does not justify the activity.

First assess the other statutory conditions. Asking for additional consent where another basis applies can mislead individuals about their control over legally required processing.

2. What makes explicit consent valid?

Consent must concern a specific matter, follow adequate information and be freely given.

1. Specific: A blanket reference to “all kinds of processing” is insufficient.
2. Informed: The person must understand the proposed activity and consequences.
3. Freely given: Bundling unnecessary processing into access to a job or service undermines freedom of choice.
4. Withdrawable: Provide a clear and easy way to withdraw. Withdrawal affects future consent-based processing; it does not retrospectively make prior lawful processing unlawful.

3. Separate privacy notices and consent: Decision 2026/347

The Board’s principle decision of 18 February 2026, No. 2026/347, addresses the mixing of information and consent. The Authority published its announcement on 24 March 2026.

• Provide information independently of whether the processing relies on consent or another condition.
• Where consent is required, present the notice and consent text separately, under different headings.
• If on one page, place the texts under separate headings with separate declarations.
• Receiving information is not an approval of processing: feedback that a notice was read must not be framed as consent to its contents.
• Where another condition applies, fulfil the information duty without also presenting an unnecessary consent request.
• Tailor the texts to the business. Use clear language explaining actual categories, purposes and legal bases; avoid copied or misleading statements and unnecessary complexity.

4. Special categories and the 2024 amendment

Law No. 7499 amended Article 6, effective 1 June 2024. The categories remained the same; the processing conditions were revised. Alongside explicit consent, the current article contains other limited grounds.

Relevant grounds for businesses include express statutory provision, necessity for the establishment, exercise or protection of a right, and necessity for legal obligations in employment, occupational health and safety, social security, social services and social assistance. Each activity must satisfy the actual statutory condition: an employment relationship alone does not justify collecting any health or biometric data.

Other Article 6 grounds cover qualifying life or bodily-integrity emergencies, data made public in accordance with the individual’s disclosure intention, specified health purposes under secrecy or competent-authority safeguards, and narrowly defined non-profit organisations’ activities. Examine the full provision rather than treating this list as unrestricted permission.

5. Common mistakes

• A single joining form purporting to authorise every employee-data use.
• Consent embedded in an employment contract without a genuine independent choice.
• Collecting signatures without first providing information.
• No accessible withdrawal route for marketing permissions.
• Confusing consent under the KVKK with permission for commercial electronic messages, which has its own legal regime.

Official sources

Law No. 6698, Articles 3, 5, 6 and 9 · Board Decision 2026/347: official announcement.