How do you write a privacy notice for a website? A section-by-section outline.

A privacy notice explains which personal data the site processes, on whose behalf, for what purpose and on what legal basis, to whom it transfers that data, and what the visitor’s rights are. The Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform lists five minimum elements; a good text presents these elements according to the processing the site actually carries out, in plain language and before processing begins.

Copying the text you find at the end of a search for a “privacy notice example” is tempting but risky: in its Principle Decision 2026/347, the Personal Data Protection Board wrote that another data controller’s text should not be used word for word and that the text should be prepared according to one’s own activity. This guide does not give you a template to fill in but a section-by-section outline, and shows where each section comes from. The information here is not legal advice; have the final version of the text checked by a lawyer.

Who is a privacy notice mandatory for?

For everyone who processes personal data. Article 10 of Law No. 6698 requires the data subject to be informed when data is obtained; the Communiqué says this is done for every processing based on explicit consent or on another processing condition, and that it does not depend on a request from the data subject. Being exempt from registration with the Data Controllers’ Registry (VERBİS) does not remove this obligation.

On a website, processing starts with the first request, long before the contact form: the server sees the visitor’s IP address, and cookies and browser records come into play. That is why the Personal Data Protection Authority’s cookie guide requires the notice to be given at the point of entering the site. The burden of proving that the notice was given also lies with the data controller.

What sections should the text have?

Article 4 of the Communiqué lists the minimum content: the identity of the data controller and, if any, its representative, the purpose of processing, to whom and for what purpose the data may be transferred, the method of collection and its legal basis, and the data subject’s rights under Article 11. For a website, turning this into the following outline keeps the text concrete:

• Data controller · identity and contact details; representative, if any
• Which data · what the site actually collects: form fields, server logs, cookies
• Purpose · a specific and explicit purpose for each data group
• Legal basis · by the name of the condition in Article 5 or 6 of the Law
• Method of collection · automated (server, cookie) or non-automated (form)
• Transfer · recipient groups and purpose of transfer; if abroad, where and on what basis
• Retention · how long it is kept, what happens when the period ends
• Rights and requests · Article 11 rights and the request channel

The “which data” and “retention” rows are not in the Communiqué’s minimum list; but they tie the text to the site’s real behavior and answer the visitor’s first question. The details of cookies can sit in a separate section or on a separate page: how to write a cookie policy.

How do you write the legal basis?

According to the Communiqué, the legal basis is stated explicitly: the text says which of the conditions in Articles 5 and 6 of the Law the data is processed on. The purpose must also be specific, explicit and legitimate; general and vague wording, and sentences that give the impression that the data will later be processed for other purposes as well, are avoided. That is why “Your personal data is processed in accordance with the legislation” is not a legal basis.

Article 5 of the Law lists the conditions other than explicit consent: being expressly provided for by law, being directly related to the conclusion or performance of a contract, the data controller’s legal obligation, the data subject having made the data public themselves, the establishment, exercise or protection of a right, and the data controller’s legitimate interest, provided that it does not harm the data subject’s fundamental rights and freedoms. In the text, the sentence pattern is the same for every data group: which data, for what purpose, based on which condition. Which condition fits your processing, however, is a legal assessment.

Why should the explicit consent text be separate?

In its Principle Decision 2026/347, the Board required that, for processing based on explicit consent, the privacy notice and the explicit consent text be drafted as separate texts under different headings; if they are to sit on the same page, one below the other and with a separate statement for each. If another processing condition is relied on, only the notice is given and no explicit consent text is presented in addition. The Board considers it appropriate to collect feedback that the notice has been read; it does not consider it appropriate to ask for approval or consent to the statements in the privacy notice.

Decision 2023/692 shows why this distinction matters. On the appointment form of a healthcare provider’s website, an appointment could not be made without ticking the explicit consent box for promotional purposes. The Board found that relying on explicit consent while other processing conditions existed was misleading and amounted to an abuse of right, imposed a fine of 300,000 TL and required the phrase “I give my approval” to be removed from the text.

What should the checkbox on the form say?

If you use a checkbox, it should confirm that the notice has been read, not ask for consent — for example: “I have read and understood the privacy notice.” Recording the confirmation together with the version of the text at that moment is a practical way to meet the burden of proof. Permission for marketing or a newsletter should be a separate box and a separate action; it should not be tied to submitting the contact form. In Decision 2024/1361, the Board found that the approval obtained on a form for marketing use did not relate to a specific matter and was not given freely; in Principle Decision 2025/1072 it also required that different approvals not be obtained through a single action.

How do you write about transfers abroad?

If your hosting, form, e-mail or analytics service is abroad, the data is being transferred abroad. Since 2024, Article 9 of the Law has set an order: an adequacy decision; failing that, appropriate safeguards; failing both, only incidental cases. According to the Authority’s page, the Board has not yet issued an adequacy decision for any country; the safeguard used in practice is the standard contract, which must be notified to the Authority within five working days of signing.

The text states the recipient group, the purpose of the transfer and its basis explicitly. The reverse also holds: under Decision 2026/347, if no transfer abroad is made, wording that gives the impression of a transfer should not be used.

How do you write the rights and requests section?

According to the principle decision, there is no need to copy the whole of Article 11 of the Law into the text; a short phrase such as “your rights under Article 11 of the Law” is enough. What really matters is how a request is made. Under the Communiqué on Applications to the Data Controller, a request may be made in writing, by registered electronic mail (KEP), with a secure electronic signature or a mobile signature, from the e-mail address the data subject previously provided and the data controller has on record, or through software developed for this purpose.

The answer is given within 30 days at the latest and, as a rule, free of charge; for a written answer, 1 TL may be charged for each page beyond ten. On 1 October 2026 the Authority issued a reminder that an answer given by phone or in person does not count as the answer the Law requires, and that the answer must be given in writing or electronically.

What mistake do the sites that were fined have in common?

Three decisions show the same thing: the text and the site’s behavior had drifted apart. In Decision 2022/1358, no notice had been given for many cookies and no consent had been obtained for non-essential cookies (300,000 TL). In 2023/692, consent had been made a precondition for the service (300,000 TL). In 2024/1361, an analytics cookie that was not strictly necessary was used without consent on first entry, and marketing approval was collected on a form (250,000 TL, and 15,000 TL for a deficient notice). In 2026, the fine for breaching the obligation to inform ranges from 85,437 TL to 1,709,200 TL.

When should the text be updated?

According to the Communiqué, if the purpose of processing changes, a separate notice is given for the new purpose before processing. In practice, the text should also be updated when a new field is added to a form, a new tool to the site or a new service provider comes in. Writing the update date at the top of the text tells the visitor, and you, which version is in force. We explained how we keep the text in line with the site’s behavior in our article on designing a KVKK-compliant website.

If you would like to work out together which data your site actually processes, write to us; the final legal check of the text stays with your lawyer.

If you want to see these answers on your own site, corporate web design delivers design, code and technical SEO from one hand, on a measurable budget.