A privacy notice is the information document that a data controller must provide to individuals whose personal data is processed, as required by Article 10 of the KVKK. It explains the controller's identity, the purposes of processing, to whom and why data is transferred, the collection method and legal basis, and the individual's rights.
Article 10 of the KVKK imposes an information duty on the data controller: when personal data is collected, the individual must be told the identity of the controller and its representative if any, the purpose of processing, to whom and why data may be transferred, the collection method and legal basis, and the rights granted by the law. This duty applies regardless of the legal basis for processing, so it exists even where no consent is needed. The GDPR regulates similar duties under its transparency principle.
A privacy notice and a consent statement are different documents: the notice is a one-sided disclosure, while consent is an active approval by the individual. Merging both into a single text confirmed with one checkbox is a common mistake. For a website, the practical steps are mapping which personal data the site collects (forms, accounts, cookies, server logs), stating a purpose and legal basis for each, listing data transfers such as hosting, analytics and advertising providers, publishing the notice where it is easy to find, and keeping it up to date.
Frequently asked questions
Is a privacy notice mandatory for every website?
Every data controller that processes personal data has an information duty. If a website collects personal data through contact forms, user accounts, cookies or server logs (and most sites do), it must publish a notice under Article 10 of the KVKK. A fully static site that processes no personal data at all could be an exception, but that is rare in practice.
Is a privacy notice the same as a privacy policy?
They are close but not identical. The privacy notice is the formal disclosure containing the mandatory elements of Article 10 of the KVKK. A privacy policy is a broader, internationally common document describing a company's overall approach to data. A site operating in Turkey can combine both functions in one document, as long as all Article 10 elements are fully covered.
This content is for information only and is not legal advice.