Duty to Inform

The duty to inform is the data controller’s obligation to tell individuals how their personal data will be processed when collecting it (KVKK Art. 10). It does not depend on a request from the individual; the controller must provide this information of its own accord.

What Information Must Be Provided?

Under the KVKK, the notice must include at least:

• The identity of the data controller and, if any, its representative,
• The purposes for which the personal data will be processed,
• To whom and for what purposes the data may be transferred,
• The method of collection and the legal basis,
• The data subject’s rights listed in Article 11 of the KVKK.

The procedures are set out in detail in the Board’s Communiqué on the Procedures and Principles for Fulfilling the Duty to Inform. Under the Communiqué, the notice must be given in understandable, clear and plain language, and the purposes and legal bases of processing must be stated specifically. General phrases such as “legal obligations” or “commercial activities” are not sufficient.

When and How?

If data is collected directly from the individual, the notice is given at the moment the data is obtained: next to a form, when a contract is signed or when registering on a website. If the data is obtained from another source, the notice is given within a reasonable time, at the first communication with the individual or, if the data will be transferred, at the latest at the time of the first transfer.

The notice may be given in writing, orally, electronically or by voice, but the burden of proving it lies with the controller. In practice, written or electronic privacy notices are therefore mostly used, and the fact that the individual saw the notice is recorded.

How It Differs from Explicit Consent

The duty to inform and explicit consent are different obligations. The notice is given in every case, whatever the legal basis; consent is obtained only if the processing is based on it. Combining the two in one text, or turning a privacy notice into consent with a “I have read and agree” box, are common mistakes.

Sanctions

A data controller that fails to fulfil the duty to inform is subject to an administrative fine under Article 18 of the KVKK, in amounts increased every year by the revaluation rate.