Introduction

On 21 July 2026, the Turkish Personal Data Protection Authority (the “Authority“) published a public announcement clarifying the legal requirements applicable to the use of personal data obtained from third parties for advertising and marketing purposes.

The announcement addresses common business practices such as referral programmes, customer recommendations and other indirect lead-generation models. The Authority emphasises that obtaining personal data from an existing customer or another third party does not, in itself, constitute a lawful basis for processing such data for advertising or marketing purposes.

Key Highlights of the Announcement

• No automatic legal basis: Obtaining contact details through referrals, customer recommendations, brand ambassadorship or similar channels does not, by itself, permit their use for marketing. Data controllers must identify and document an appropriate legal basis under the Law before any marketing communication.
• Disclosure is mandatory and time-bound: Under Article 6 of the Communiqué, individuals whose data are obtained indirectly must be informed within a reasonable period, at the latest at the first communication where the data are used to contact them, and at the latest at the first transfer. For marketing calls and SMS, this means disclosure no later than the first contact, covering the Article 10 content (controller identity, purposes, transfers, method and legal basis, and the individual’s rights).
• Explicit consent must be separate and cannot be inferred: Listening to a call, not ending it, asking questions, or not replying to a marketing SMS is not valid consent. Where consent is required, data controllers should fulfil the disclosure obligation first and then obtain separate, specific, informed and freely given consent (Article 5 of the Communiqué).
• Enforcement: Data controllers that breach their obligations may be subject to administrative sanctions under Article 18 of the Law.

Conclusion

While the announcement does not introduce new legal obligations, it provides important guidance on the Authority’s approach to the use of personal data obtained from third parties for advertising and marketing purposes.

Data controllers operating referral programmes, customer recommendation campaigns or other indirect lead-generation models should review their marketing practices, first-contact procedures and consent mechanisms in light of the Authority’s guidance. Particular attention should be given to ensuring that the disclosure obligation is fulfilled, explicit consent mechanisms are properly structured and the applicable legal basis for processing is appropriately documented.

The full text of the Authority’s announcement is available here.