Under Article 10 of the KVKK, the duty to inform requires every data controller that processes personal data to inform the data subject in advance. This obligation applies everywhere you collect data: on your website, in your customer forms, at your call center, in your event registrations — in short, at every point where you gather personal data.
What a Disclosure Notice Must Contain
Under Article 5 of the "Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Duty to Inform," the following information must be included:
- Identity of the data controller: Company name, tax number, and address.
- Categories of personal data processed: Identity, contact, financial, health, and so on.
- Purposes of processing: Sales, marketing, logistics, legal obligations, and the like.
- Legal basis for processing: Which of the grounds under Article 5/2 of the KVKK applies.
- Transfers: Third parties to whom data is transferred, both domestically and abroad.
- Collection method: Forms, automated means, contracts, telephone, and so forth.
- Rights of the data subject (Article 11): All eight rights should be listed one by one.
- How to apply: Registered email (KEP), email, and postal address.
Template Structure
Regardless of your sector or line of business, the following structure can be used:
- Introduction / Overview (one paragraph)
- Identity of the Data Controller
- Definitions
- Categories of Data Processed
- Purposes of Processing
- Legal Bases
- Collection Method
- Transfers (domestic / international)
- Retention Period
- Security Measures
- Rights of the Data Subject
- Application Procedure
- Use of Cookies (for websites)
- Changes
- Contact
Key Drafting Rules
- Use clear, plain language: Keep legal jargon to a minimum. Write so that the data subject can actually understand it.
- Avoid vague statements: Instead of "processed for various purposes," write "invoicing, shipment tracking, customer support."
- Obtain explicit consent separately: A disclosure notice is not a consent statement. Explicit consent requires its own separate checkbox.
- Make it visible: Rather than small print at the bottom of the page, place it directly above the form or attach it to it.
- Add a date: For example, "Last updated: 25.05.2026."
Common Mistakes
- Copying the notice from another company (its sector and data categories may differ).
- Confusing the disclosure notice with the "Terms of Use."
- Obtaining explicit consent through a pre-ticked mandatory checkbox (this is invalid).
- Failing to disclose international transfers.
- Placing the notice only on the homepage and never integrating it into the forms.
- Listing the rights under Article 11 of the KVKK incompletely or incorrectly.
Notices Tailored to Each Data Collection Point
A single disclosure notice is not enough. A separate notice — or at least a dedicated section — is recommended for each data collection point:
- General website disclosure notice
- Contact form disclosure notice
- Demo request form disclosure notice
- Job applicant (CV submission) disclosure notice
- Call center disclosure notice
- Camera (CCTV) disclosure notice
- Wi-Fi captive portal disclosure notice
SignLogger's Sample Disclosure Notice
You can review the comprehensive KVKK disclosure notice on our own website as a reference: /en/legal/kvkk
That notice contains 16 separate sections, covering the data controller, definitions, 8 data categories, 11 processing purposes, the legal bases under Article 5/2 of the KVKK set out item by item, a retention period table, security measures, the rights under Article 11 of the KVKK, and the application procedure.
Disclosure Notices on the Guest Wi-Fi Portal
The Wi-Fi portal screen is the disclosure point businesses forget most often. Yet this is precisely where phone numbers and traffic data are processed. A portal disclosure notice should include the following:
- Data controller: The business's name and contact details
- Data processed: Phone number, MAC/IP address, and connection timestamps
- Purpose and legal basis: Fulfilling the obligations under Law No. 5651 (a legal obligation — not explicit consent; see the Explicit Consent guide)
- Retention period: The statutory period (see the retention period guide)
- Transfers: Only to authorized judicial/administrative authorities, upon request
- Rights: The application rights under Article 11 of the KVKK
A link to the disclosure notice can be added to the SignLogger captive portal screen, so that the notice is presented automatically on every authentication flow. For portal setup, see the Law No. 5651 Logging Obligation guide.
The Layered Disclosure Approach
Long notices go unread. The Board's guidance recommends "layered" information: a 3-4 sentence summary on the first screen (who, what, why), with a link to the "detailed notice" beneath it. The same content can be presented in different ways for the portal, the web form, and physical settings (such as a QR-coded sign).
Frequently Asked Questions
Does the disclosure notice need to be approved?
No — informing is not the same as consent; an "I have read and understood" checkbox is not mandatory. However, keeping a record that the notice was displayed within the portal flow is good practice, so that you can prove it was actually presented.
Is one notice enough for every channel?
The content may stay the same, but it must be adapted to each channel's own data set; the notice on the Wi-Fi portal cannot be identical to the cookie notice on your website.