Türkiye’s Personal Data Protection Authority (KVKK) published the Announcement on the Use of Personal Data Obtained from Third Parties for Advertising and Marketing Purposes on 21 July 2026. It clarifies that enterprises cannot rely merely on “friend referral” or “customer referral” as a legal basis for processing personal data to conduct marketing activities.
1. Obtaining data from third parties does not constitute a valid legal basis by itself
KVKK states in the announcement that many enterprises acquire contact details such as phone numbers and email addresses from third parties (existing customers, business partners, etc.) via referrals or brand ambassador programmes, then directly use them for marketing calls and SMS without notifying the data subjects or obtaining their consent. The authority clarifies that the mere fact that personal data was sourced from a third party does not qualify as a lawful basis for advertising or marketing use.
Many marketers operate under the assumption: “If a friend shared the number, the person must not mind being contacted.” KVKK explicitly rejects this logic. Data controllers must prove the lawfulness of processing by relying on at least one lawful basis defined under Article 5 of Türkiye’s Law No.6698 on Personal Data Protection. The proper question is not “Did we get consent?”, but “Which legal ground supports this marketing campaign, and can we document this assessment in writing?”
2. Silence does not equal consent
The authority rejects implied consent. If a data subject stays on a marketing call, does not hang up, asks questions, or fails to reply with a “STOP” SMS, none of these actions count as valid explicit consent. Explicit consent must be a voluntary, informed, affirmative statement given for a specific purpose.
This ruling ends the long-standing call centre logic of “no objection means consent”. Enterprises may no longer interpret consumer inaction as authorisation.
3. Notification obligation and consent are separate legal requirements
Data controllers must first fulfil information disclosure obligations and, where required, obtain the data subject’s explicit consent via a separate statement of intent. Where data is not collected directly from the data subject, disclosure must be completed upon first contact or first transmission. Violations may trigger administrative penalties under Article 18 of the Personal Data Protection Law.
Notification and consent are two independent steps and cannot be merged. When contacting prospects for the first time, enterprises must complete privacy disclosure before or at the time of first contact, informing the individual of data source, processing purposes and data subject rights. Where explicit consent is required as the legal basis, a separate consent statement must be collected after the information disclosure.
