KVKK compatible data management with SAP PDP
Matters to be considered while obtaining explicit consent
Explicit consent, within the framework of the law, means that the individual grants consent to the processing of his/her personal data at his/her own will or upon request from other parties. With the explicit consent statement, the person actually informs a data controller about his/her legal value. Explicit consent will enable the relevant person to determine the limits, scope, form, purpose and duration of the data allowed to be processed.
There is no need to obtain explicit consents with hard-copy documents and signatures; e-Mail is also a legitimate option to acquire explicit consents as long as the data controller discharges its proof obligation.
A legitimate explicit consent should have 3 three elements:
- Being related to a specific subject (or purpose)
- The consent is based on information
- Disclosure with free will
A general explicit consent which is not limited to a specific subject and not limited to the relevant purpose is not accepted, meaning that it is legally invalid. For example, consent declarations that do not indicate a specific subject or activities such as «all kinds of commercial transactions, all kinds of banking transactions and all kinds of data processing activities» are situations that can be considered within the scope of invalid consent.
Since giving explicit consent is an individual right, a given explicit consent can be revoked. In this context, as the right to determine the future of personal data belongs to the relevant person, the person can withdraw the explicit consent given to the data controller at any time. However, because the revocation process will have a forward-looking result, all activities carried out based on the explicit consent should be stopped by the data controller as soon as the withdrawal declaration reaches the data controller. In other words, the withdrawal declaration becomes effective from the moment it reaches the data controller.
