Cybersecurity law & regulation in Turkey (2026)

Legal framework

Cybersecurity Law No. 7545 (in force 19 March 2025); Cybersecurity Presidency (Siber Güvenlik Başkanlığı, est. Presidential Decree No. 177, 8 January 2025); Personal Data Protection Law No. 6698 (KVKK)

Key points: cybersecurity in Turkey

1. 01Law No. 7545, Scope & Entry into Force

   Adopted by the Grand National Assembly on 12 March 2025 and published in the Official Gazette on 19 March 2025, Law No. 7545 is Turkey's first comprehensive cybersecurity statute. It applies to public institutions, professional bodies with public status, private legal entities, and organisations without legal personality that operate in cyberspace; intelligence agencies (MİT, Armed Forces, Gendarmerie) are excluded.

   loc.gov mondaq.com

2. 02Cybersecurity Presidency

   The Cybersecurity Presidency (Siber Güvenlik Başkanlığı) was established by Presidential Decree No. 177 on 8 January 2025 and confirmed as the apex regulatory and certification authority by Law No. 7545. It absorbed all cybersecurity assets and responsibilities previously held by BTK (Information and Communication Technologies Authority) and the Digital Transformation Office within six months of the law's publication.

   hhklegal.com pilc.law

3. 03Incident Reporting Obligations

   Article 7(1)(b) of Law No. 7545 requires all in-scope entities to report cyber incidents and vulnerabilities to the Cybersecurity Presidency without delay. The duty extends beyond malicious attacks to internal errors and technical failures. Critical infrastructure operators that maintain a Corporate Cyber Incident Response Team (SOME) must additionally notify USOM (National Cyber Incident Response Centre) and their sectoral SOME without delay.

   mondaq.com corporatecomplianceinsights.com

4. 04Critical Infrastructure Heightened Duties

   The Cybersecurity Presidency is empowered to designate sectors as critical infrastructure (energy, telecommunications, finance, and healthcare are expected to be primary designees) and to impose tailored technical and administrative obligations, mandatory security audits, and certification requirements specific to each sector.

   mondaq.com cms-lawnow.com

5. 05KVKK, Personal Data Breach Notification

   Separately, Personal Data Protection Law No. 6698 (KVKK) Article 12(5) requires data controllers to notify both affected individuals and the Personal Data Protection Board within 72 hours of becoming aware of a breach. The KVKK framework runs in parallel to Law No. 7545 and is enforced by the Personal Data Protection Authority (KVKK Kurumu).

   resourcehub.bakermckenzie.com dlapiperdataprotection.com

6. 06Penalties

   Law No. 7545 introduces a tiered administrative fine regime: TRY 100,000-1,000,000 for reporting/monitoring failures; TRY 1,000,000-10,000,000 for general cybersecurity duty breaches; TRY 10,000,000-100,000,000 for critical infrastructure operator violations. For the first time in Turkish law, revenue-based fines of up to 5% of gross annual sales apply to commercial entities. Secondary implementing regulations are pending.

   istanbullawyerfirm.com cbclaw.com.tr

Timeline of decisions

1. 19 Mar 2025Law
   Cybersecurity Law No. 7545 Published, Turkey's First Standalone Cybersecurity Statute

   Published in the Official Gazette on 19 March 2025, Law No. 7545 establishes a Cybersecurity Presidency (created by Presidential Decree No. 177 on 8 January 2025) and a Cybersecurity Board, mandates incident reporting and regular audits for all public and private entities in cyberspace, and imposes criminal penalties and activity bans for non-compliance after a one-year transition period.

   Paksoy Attorneys at Law

2. 19 Mar 2025Law · official
   Comprehensive Cybersecurity Law No. 7545 Enacted

   Turkey's first dedicated cybersecurity law was published in Official Gazette No. 32846, establishing the Cybersecurity Council, mandating transfer of BTK's cybersecurity functions to the new Cybersecurity Directorate within six months, and imposing sector-wide obligations, including asset inventories, risk assessments, and mandatory certification, on critical-infrastructure operators in energy, finance, health, and telecoms. Administrative fines range from TRY 1 million to TRY 100 million.

   Turkish Official Legislation Portal (Mevzuat.gov.tr)

3. 8 Jan 2025Decision · official
   Cybersecurity Directorate Established by Presidential Decree No. 177

   The Presidency created a standalone Cybersecurity Directorate as a public legal entity with financial autonomy, separating national cybersecurity execution from BTK and the Digital Transformation Office ahead of the March 2025 law. The Directorate will absorb all cyber-related assets and personnel from both bodies within six months of Law No. 7545.

   Digital Transformation Office of the Presidency of Turkey

4. 9 Sept 2024Incident
   Government Confirms Breach of 108 Million Citizens' Personal Data

   Turkish officials admitted that names, ID numbers, addresses, and phone data for approximately 108 million citizens were stolen from government servers and stored in Google Drive files; BTK contacted Google to have the files removed. The incident directly catalyzed parliamentary passage of the 2025 Cybersecurity Law.

   Duvar English (ministerial confirmation report)

5. 4 Jan 2023Guidance
   Information and Communication Security Compliance and Audit Monitoring System Launched

   BTK activated a centralised automated platform to continuously track and audit public institutions' compliance with the 2020 Information and Communication Security Guide, marking a shift from self-reporting to real-time regulatory monitoring of the country's cyber hygiene posture.

   ICLG Cybersecurity Laws and Regulations 2026 – Turkey

6. 24 Jul 2020Guidance · official
   Information and Communication Security Guide Formally Approved

   Issued under Presidential Circular 2019/12, the Guide sets mandatory technical and administrative controls, encrypted server communications, domestic storage of sensitive national data (health, biometric, population records), and institutional email hosting in Turkey, applying to all public bodies and critical-infrastructure operators.

   Digital Transformation Office of the Presidency of Turkey

7. 29 Dec 2019Guidance · official
   National Cybersecurity Strategy and Action Plan 2020-2023 Published in Official Gazette

   The third-generation national strategy introduced a proactive cyber posture, 24/7 critical-infrastructure protection, systematic risk analysis, and explicit targets to reduce dependency on foreign IT vendors, superseding the 2016-2019 plan and aligning with the 2023 national vision.

   Ministry of Transport and Infrastructure of Turkey (UAB)

8. 1 Jan 2016Guidance · official
   National Cybersecurity Strategy and Action Plan 2016-2019 Published

   The second national strategy formalised objectives across cyber defence, critical-infrastructure protection, cybercrime deterrence, and human-capital development, and for the first time explicitly embedded cybersecurity targets within Turkey's 2023 national development vision.

   Ministry of Transport and Infrastructure of Turkey (UAB)

9. 29 Sept 2014Law · official
   Turkey Ratifies the Budapest Convention on Cybercrime

   Turkey deposited its instrument of ratification of the Council of Europe's Budapest Convention, the primary international treaty on cybercrime and electronic evidence, aligning Turkish substantive criminal law and mutual legal-assistance procedures with European standards.

   Council of Europe – Cybercrime Division

10. 1 Jan 2013Decision · official
    First National Cybersecurity Strategy 2013-2014 Adopted; USOM/TR-CERT Established

    The inaugural National Cybersecurity Strategy and Action Plan was approved by the newly formed Cybersecurity Board, and the National Cyber Incident Response Centre (USOM/TR-CERT) was stood up under BTK alongside sector-level Cyber Incident Response Teams (SOMEs), creating the operational incident-response architecture that underpins today's framework.

    Information and Communication Technologies Authority (BTK)

11. 20 Oct 2012Decision · official
    Cybersecurity Board (Siber Güvenlik Kurulu) Established; BTK Named National Coordinator

    Council of Ministers Decree No. 2012/3842, published in the Official Gazette on 20 October 2012, established the Cybersecurity Board as Turkey's first whole-of-government cybersecurity governance body and designated BTK as the national coordination authority, the foundational institutional act for all subsequent strategy and regulation.

    Information and Communication Technologies Authority (BTK)

12. 23 May 2007Law · official
    Internet Law No. 5651 Enacted, Foundational Internet and Cybercrime Statute

    Law No. 5651 on Regulation of Publications on the Internet established Turkey's legal framework for internet-based offences, imposing cooperation and data-preservation obligations on ISPs and enabling content blocking, the foundational statute on which successive cybersecurity and data-protection regulation was layered.

    Turkish Official Legislation Portal (Mevzuat.gov.tr)

Sources

1. 1.loc.gov/item/global-legal-monitor/2025-07-11/turkey-comprehensive-cybersecuri
2. 2.mondaq.com/turkey/security/1623030/a-new-era-in-cybersecurity-in-t%C3%BCrkiye-th
3. 3.mondaq.com/turkey/cybersecurity/1756112/t%C3%BCrkiyes-cybersecurity-law-no-7545-
4. 4.hhklegal.com/2025/05/27/a-new-era-in-cybersecurity-in-turkey-law-no-7545-on-cybers
5. 5.cms-lawnow.com/en/ealerts/2025/03/tuerkiye-adopts-first-cybersecurity-law
6. 6.resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/emea/turkiye/topics/secur
7. 7.dlapiperdataprotection.com/index.html?t=breach-notification&c=TR
8. 8.iclg.com/practice-areas/cybersecurity-laws-and-regulations/turkey
9. 9.cbclaw.com.tr/en/legal-shield-for-digital-security-turkeys-first-cyber-security-law
10. 10.istanbullawyerfirm.com/blog/turkish-cybersecurity-law-compliance
11. 11.pilc.law/establishment-of-cybersecurity-presidency-in-turkey/
12. 12.corporatecomplianceinsights.com/inside-turkey-new-cybersecurity-regulation/