DUAL TRANSFORMATION IN DATA PROTECTION LAW PRACTICE: STRONGER LEGAL STANDARDS AND COMPETENT COURTS
Dual Transformation In Data Protection Law Practice: Stronger Legal Standards and Competent Courts
In 2026, Türkiye’s personal data protection framework has undergone significant developments, marking a new phase in both regulatory standards and enforcement practice. The Personal Data Protection Board (the “Board”), in its Principle Decision dated 18 February 2026 (No. 2026/347), published in the Official Gazette dated 24 March 2026 under No. 33203, clarified that data controllers must prepare explicit consent forms and disclosure notices as separate instruments.This was followed by Decision No. 890 of the First Chamber of the Council of Judges and Prosecutors, dated 20 April 2026 and published in the Official Gazette dated 22 April 2026 under No. 33232, pursuant to which, effective as of 1 June 2026, disputes arising from Board decisions will be heard before designated specialized administrative courts in Ankara.
Key Principles Foreseen by the Decisions
Pursuant to Decision No. 890 of the First Chamber of the Council of Judges and Prosecutors, dated 20 April 2026 and published in the Official Gazette dated 22 April 2026 under No. 33232, annulment actions brought against Board decisions will, as of 1 June 2026, be heard before specialized administrative courts designated in Ankara. The purpose of this arrangement is to consolidate administrative disputes arising in the field of personal data protection before a defined set of courts, thereby fostering specialized judicial practice and strengthening consistency in judicial decisions.
The Board's Principle Decision No. 2026/347, published in the Official Gazette dated 24 March 2026 under No. 33203, has put an end to the common practice of including explicit consent declarations and disclosure notices in the same document. Under the Principle Decision, the discharge of the obligation to inform and the process of obtaining explicit consent are of distinct legal character and must be assessed separately in terms of their purpose, scope, and legal consequences. Data controllers are now required to present disclosure notices to data subjects in a separate, clear, and intelligible form and, where explicit consent is necessary, to establish a discrete consent mechanism that is specific to a particular purpose, based on informed acknowledgment, and provided by the data subject acting of their own free will.
Practical Impact of the Decisions
The most significant consequence of these developments for companies is that compliance processes under Law No. 6698 on the Protection of Personal Data (“KVKK”) must be revisited and restructured. Many practices previously carried out through the use of standard texts or template forms must now be reassessed in light of substantive legal standards and the burden of proof.
To this end, data controllers must first conduct a comprehensive review of all processes and channels through which personal data processing activities occur. At every touchpoint where explicit consent is collected, including websites, mobile applications, call center workflows, human resources processes, customer membership systems, and physical application forms, the disclosure obligation and the explicit consent process must be operationally separated.
It must also be emphasized that separating the texts alone is insufficient. Records must be created and retained showing the date on which the disclosure notice was presented, the version in effect at that time, the channel through which it was delivered, the scope of the consent granted by the data subject, whether such consent was subsequently withdrawn, and the technical audit trail by which the entire process can be verified. Companies lacking adequate record-keeping and evidentiary infrastructure should note that formal compliance documents will not, standing alone, constitute a sufficient defense.
The concentration of annulment actions against Board decisions before the specialized administrative courts in Ankara will, in turn, contribute to the formation of a distinct judicial practice in data protection law. In disputes of significant technical and legal complexity, this is expected to yield more consistent decisions, greater predictability in practice, and the gradual development of a stable body of case law. The initial decisions handed down by these courts are likely to carry considerable precedential weight.
Conclusion
Having considered together the Board’s Principle Decision No. 2026/347, published in the Official Gazette dated 24 March 2026 under No. 33203, and Decision No. 890 of the First Chamber of the Council of Judges and Prosecutors, published in the Official Gazette dated 22 April 2026 under No. 33232, it becomes clear that these developments crystallize a new era in Türkiye’s personal data protection framework. The substantive legal standard applicable to explicit consent processes has been materially elevated, while a competent court structure has been established to ensure effective judicial oversight of such standards. Companies that continue to operate combined disclosure and consent processes, lack adequate record-keeping and evidentiary infrastructure, or have not revised their data processing activities to comply with current legislation and Board guidance are likely to face a considerable risk of administrative sanctions and judicial challenges.