The Principle Decision dated 18 February 2026 and numbered 2026/347 (“Decision”) of the Personal Data Protection Board ( “Board”), published in the Official Gazette dated 24 March 2026 and numbered 33203, sets out the Board’s assessments regarding privacy notices and explicit consent texts that are improperly drafted by data controllers in practice, and includes examples of both compliant and non-compliant practices.
In the Decision, the Board identifies the most common unlawful practices observed in complaints and notifications submitted to the Personal Data Protection Authority. These include the presentation of explicit consent and privacy notices within a single text, obtaining consent for the provision of the privacy notice, the verbatim use of texts prepared by other data controllers, the use of complex, lengthy, or unintelligible texts, and the inclusion of inaccurate or incomplete information.
