Critical Guidance from the Turkish DPA on the Use of Third-Party Data in Advertising and Marketing Activities
- 2 days ago
- 3 min read
Selin Çetin Kumkumoğlu
Of Counsel
Yaren Alparslan
Associate
Buse Sığın
Trainee
On 21 July 2026, the Turkish Personal Data Protection Authority (the "Authority") published a public announcement in response to the increasing number of complaints regarding the use of contact information obtained from third parties for advertising and marketing purposes. The announcement addresses the processing, under the Turkish Personal Data Protection Law No. 6698 (the "DPL"), of telephone numbers, e-mail addresses and similar contact details obtained from existing customers or other third parties through methods such as referrals, recommendations, brand ambassador programmes or customer referrals, where such data are used for marketing activities without providing the relevant data subjects with the required information notice and without satisfying the applicable legal requirements.
Legal Basis for the Processing of Personal Data
The Authority expressly states that the mere fact that personal data have been obtained from a third party does not, in itself, constitute a legal basis for processing such data for advertising and marketing purposes. Accordingly, data controllers are required to assess, on a case-by-case basis, whether any of the legal grounds for processing set out under Article 5 of the DPL are applicable. Where the processing activity relies on explicit consent, such consent must be obtained from the relevant data subject in accordance with the requirements prescribed by the DPL.
Information Obligation
The announcement also reiterates the obligations of data controllers with respect to the information obligation where personal data are not collected directly from the relevant data subject. In this regard, pursuant to the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, data controllers are required to provide the relevant data subject with the information notice, as applicable:
within a reasonable period following the collection of the personal data;
at the time of the first communication with the data subject where the personal data will be used for such communication; or
at the latest, at the time of the first disclosure where the personal data will be transferred.
The Authority further notes that, in practice, where contact information obtained from third parties is used for direct marketing activities, data subjects are frequently neither provided with the information required under the DPL nor directed to an information notice.
Validity of Explicit Consent
The Authority also clarifies certain misconceptions encountered in practice. In this respect, it emphasizes that a data subject's failure to terminate a marketing call, request for further information regarding a campaign, or failure to opt out by responding to a marketing SMS cannot be interpreted as constituting explicit consent to the relevant marketing activity. Under the DPL, valid explicit consent must constitute a freely given, specific and informed indication of the data subject's wishes.
In addition, the Authority reiterates that the obligation to inform and the obligation to obtain explicit consent are two separate and independent legal requirements. Accordingly, compliance with one obligation does not eliminate the need to fulfil the other where required under the applicable legislation.
Conclusion and Assessment
The Authority's public announcement highlights the need for businesses to reassess their practices regarding the use of personal data obtained from third parties for advertising and marketing purposes, particularly with a view to mitigating the risk of administrative sanctions. In light of the Authority's position, data controllers should review their processing activities to ensure compliance with the DPL and the relevant secondary legislation, especially with respect to the applicable legal basis for processing, the fulfilment of the information obligation and, where required, the valid collection of explicit consent.
