Türkiye’s cybersecurity framework has moved rapidly from legislative reform in 2025 to institutional implementation, supervision and operational compliance in 2026. Law No. 7545 on Cybersecurity now operates alongside data protection, internet and electronic communications legislation, criminal law and sector-specific rules, creating a multi-layered compliance environment rather than a single standalone cybersecurity regime. At the centre of this architecture is the Cybersecurity Presidency, established in January 2025 as the central administrative authority responsible for national cybersecurity policy and coordination.

The Cybersecurity Board provides the high-level strategic layer, while the Presidency, TR-CERT/USOM, institutional and sectoral Cyber Incident Response Teams (SOME), the Personal Data Protection Authority and sector regulators perform distinct but sometimes overlapping functions. For businesses, the central challenge is determining which requirements apply generally, which arise from critical-infrastructure status or sector regulation, and which measures represent guidance or recognised best practice rather than universal statutory duties. Cyber incidents may simultaneously trigger cybersecurity, personal-data, sector-regulatory, contractual and potentially civil or criminal consequences. The emerging framework also places increasing emphasis on auditability, documented risk governance, incident readiness and third-party oversight. Cybersecurity should therefore be treated not merely as an IT function, but as a regulatory, governance, operational-resilience and board-level legal risk.

1. Cybersecurity in Türkiye: From Legislative Reform to Implementation

Türkiye entered a new phase of cybersecurity regulation in 2025 with the establishment of the Cybersecurity Presidency and the enactment of Law No. 7545 on Cybersecurity. The Presidency was established on 8 January 2025 by Presidential Decree No. 177 as a public legal entity attached to the Presidency, with responsibilities encompassing national cybersecurity policy, coordination, critical-infrastructure protection, cyber-threat and vulnerability management and crisis preparedness. Law No. 7545 followed on 19 March 2025, providing the principal statutory framework for cybersecurity governance, duties, supervision, sanctions and relevant offences.

By 2026, the emphasis had shifted from legislative creation towards implementation. The Cybersecurity Board met under the chairmanship of the President on 5 May 2026 and addressed national cyber risks, critical infrastructure, digital sovereignty and resilience. The key question for organisations is consequently no longer simply what the new Cybersecurity Law provides, but how Türkiye’s new institutional architecture translates into operational compliance and supervision.

2. Türkiye’s Multi-Layered Cybersecurity Legal Framework

Cybersecurity compliance in Türkiye does not arise from a single statute. Law No. 7545 provides the horizontal cybersecurity framework but operates alongside Personal Data Protection Law No. 6698 (KVKK), Law No. 5651 on internet publications, Electronic Communications Law No. 5809, the Turkish Criminal Code and sector-specific legislation. The regulatory consequences therefore depend on the organisation and activity concerned. Banking and payment institutions, electronic communications operators, capital-market actors, crypto-asset service providers, healthcare organisations and critical infrastructure may face additional requirements under their respective regimes. The practical consequence is significant: one cyber event may engage several legal frameworks simultaneously. Effective compliance requires mapping cybersecurity duties together with data-protection, sectoral, contractual and potentially criminal-law exposure.

3. Cybersecurity Presidency and Cybersecurity Board

The Cybersecurity Presidency sits at the centre of Türkiye’s national cybersecurity governance structure. Its responsibilities include determining policies and strategies, coordinating implementation, protecting critical infrastructure, identifying threats and vulnerabilities, reducing cyber risks and supporting crisis-management mechanisms. The cybersecurity functions and related implementation infrastructure of the former Digital Transformation Office were transferred to the Presidency. The Presidency should nevertheless be distinguished from sector regulators and other competent authorities. BTK retains its regulatory role in electronic communications, while other authorities remain responsible within fields such as banking, capital markets and personal-data protection. The Cybersecurity Board, in turn, provides the high-level strategic and coordination layer. This creates a multi-authority model in which cybersecurity regulation increasingly intersects with established sectoral supervision.

4. Who is Subject to Türkiye’s Cybersecurity Regime?

Law No. 7545 has a broad, function-based scope encompassing specified public bodies, natural and legal persons, organisations without legal personality and critical infrastructure operators operating, existing or providing services in cyberspace. It should not therefore be understood as legislation applying only to technology companies. The intensity of regulation is not uniform. Public institutions and critical infrastructure operators occupy a particularly regulated position, while organisations in banking, telecommunications, capital markets, healthcare and other regulated industries may simultaneously face sector-specific requirements. Foreign businesses should likewise assess their Turkish operations entity by entity and activity by activity. A local establishment, regulated activity, protected information or participation in critical services may materially alter the applicable compliance profile.

5. Core Obligations: Mandatory Rules, Sectoral Duties and Guidance

A central distinction in Turkish cybersecurity law is between general statutory obligations, entity- or sector-specific mandatory requirements, applicable Presidency frameworks and guidance, and recognised cybersecurity best practice. These categories should not be treated as interchangeable. Law No. 7545 establishes the overarching cybersecurity framework. Additional technical, organisational, audit, reporting or resilience requirements may arise because an organisation operates in a regulated sector or qualifies as critical infrastructure. Nor should every recognised cybersecurity measure be presented as a universal legal obligation. Requirements concerning matters such as dedicated cybersecurity governance structures, penetration testing or prescribed technical controls may be mandatory in particular regulatory contexts without applying identically to every private company. A sound compliance assessment should therefore ask: What does the legislation require? What additional rules apply to this entity or sector? Which Presidency frameworks apply? What further controls should be adopted as proportionate cybersecurity practice?

6. Critical Infrastructure Protection

Critical infrastructure occupies a central position because compromise of essential systems can affect national security, public services, economic stability and societal resilience. On 5 May 2026, the Cybersecurity Board designated 15 critical infrastructure sectors: Digital Infrastructures, Digital Services, Electronic Communications, Energy, Finance, Food and Agriculture, Manufacturing, Public Services, Media and Crisis Communications, Postal and Cargo Services, Healthcare, Defence Industry, Water Management, Transportation and Space. The Presidency applies a risk-management approach aimed at strengthening resilience, coordination and continuity of critical services. Critical-infrastructure compliance should therefore be treated as an ongoing resilience process rather than a one-off certification exercise.

7. TR-CERT/USOM, SOME and Türkiye’s Cyber Incident Response Architecture

Türkiye’s incident-response architecture combines central coordination with institutional and sector-level capabilities. SOME (Siber Olaylara Müdahale Ekipleri) constitute an important operational layer within this structure. The Presidency’s current framework distinguishes sectoral and institutional SOME and uses the SOME Communication Platform (SİP) as a secure communication mechanism. The Presidency states that SİP membership is mandatory for public institutions and organisations operating in critical sectors, while other private organisations may participate voluntarily. This operational response architecture should be distinguished from regulatory notification. Technical coordination with TR-CERT/USOM or a SOME does not by itself determine whether separate notification must be made under data-protection or sector-specific law.

8. Cyber Incident Reporting and Personal Data Breach Notification

A cyber incident and a personal-data breach are not legally synonymous. An infrastructure attack may constitute a cyber incident without involving personal data, while another event may simultaneously trigger cybersecurity-response and KVKK obligations. Under Article 12(5) KVKK, where processed personal data are unlawfully obtained by others, the controller must notify the affected persons and the Personal Data Protection Board. The Board interprets “as soon as possible” as requiring notification to the Board without delay and no later than 72 hours after becoming aware of the breach; affected persons must be informed within the shortest reasonable period after they are identified. The Authority’s 2026 materials continue expressly to apply this standard. The 72-hour period should therefore not be described as a universal deadline for all cyber incidents. Depending on the event and organisation, cybersecurity authorities, sector regulators, affected persons, contractual counterparties and insurers may each require separate consideration. An effective incident-response plan should contain a notification matrix identifying the trigger, recipient, deadline, responsible decision-maker and required information for each potentially applicable regime.

9. The 2026 Information and Communication Security Framework

The Information and Communication Security Guide and its associated audit framework form an important part of Türkiye’s operational security architecture. On 1 March 2026, the Presidency published the current Guide, Audit Guide, forms, templates and the mapping between the Guide and TS ISO/IEC 27001 controls; implementation FAQs followed on 15 May 2026. These materials should not be presented as a universal code applying identically to all private businesses. The Presidency states that, subject to applicable exceptions, public institutions within the state organisation and critical infrastructure operators maintaining IT units or procuring IT services are required to undertake Guide-compliance and audit activities. The Guide is expressly conceived as a living document, capable of evolving with changing technologies, needs and circumstances.

10. Cybersecurity Audits, Supervision and Enforcement

Türkiye’s emerging cybersecurity framework increasingly asks whether organisations can demonstrate implementation, rather than merely produce policies. Law No. 7545 gives the Presidency significant supervisory functions. For entities covered by the Information and Communication Security framework, the Presidency states that internal audit work is expected at least annually, with results transmitted to the Presidency. Compliance, audit and ISO/IEC 27001-aligned information-security management activities are monitored through BİGDES. For organisations, the practical objective should therefore be inspection readiness: responsibilities, risk assessments, implemented controls, incident records and remediation measures should be capable of being demonstrated when required.

11. Sector-Specific Cybersecurity Requirements

The horizontal framework under Law No. 7545 does not displace existing sector-specific regulation. Banking and financial services are among the more prescriptively regulated areas, with information-systems, authentication, outsourcing, business-continuity and operational-security requirements. Electronic communications remain subject to BTK regulation, while capital-market and crypto-asset activities fall within the relevant CMB framework. Healthcare organisations must consider cybersecurity alongside the heightened protection applicable to health data. Critical-infrastructure status may add another layer irrespective of sector. Cybersecurity compliance in regulated industries should consequently be approached as a regulatory mapping exercise, not through a single generic checklist.

12. Cybersecurity as a Board-Level Legal Risk

Cybersecurity should no longer be regarded solely as an IT-department responsibility. Material cyber risks affecting business continuity, confidential information, customer assets or regulatory compliance can engage corporate governance and management responsibilities. Under the Turkish Commercial Code, directors and persons entrusted with management are subject to duties of care and loyalty. Depending on the company and circumstances, the risk-management framework under Articles 369, 378 and the liability principles of Article 553 may become relevant to cybersecurity governance. Board oversight does not mean directors must personally manage technical controls. It means material cyber risks should be subject to appropriate governance, reporting, resources, escalation and oversight. Known vulnerabilities left unaddressed, policies existing only on paper, unmanaged critical-vendor risks or inadequate incident escalation may consequently have significance beyond technical cybersecurity.

13. Cross-Border Data, Cloud Services and Third-Party Cyber Risk

Cloud services, global security platforms, managed detection services and technology suppliers create overlapping cybersecurity, data-protection, sectoral and contractual issues. There is no single general rule requiring all cybersecurity-related data generated in Türkiye to remain domestically stored. Cross-border transfers of personal data must, however, comply with Article 9 KVKK, while regulated sectors may impose additional requirements.

Security telemetry illustrates the issue. Logs, identifiers, authentication records and threat-detection information transmitted to an overseas cloud or Security Operations Centre may contain protected information. Organisations should therefore identify what leaves Türkiye, where it is processed, who accesses it and on what legal basis. Third-party risk should similarly be addressed through due diligence, contracts and ongoing oversight. Outsourcing technical functions does not necessarily outsource regulatory responsibility.

14. Civil Liability, Cyber Litigation and Remedies

Cyber incidents may generate private-law consequences in addition to regulatory enforcement. Depending on the circumstances, claims may arise from breach of contract, tort, violation of personality rights, unlawful processing of personal data or unfair competition. Evidence management is particularly important. Logs, forensic records, access histories, internal communications and vendor information may later determine how an incident occurred, what safeguards existed and whether reasonable measures were taken. Technical containment should therefore be coordinated from an early stage with evidence preservation, regulatory reporting and potential litigation strategy. Available remedies will depend on the facts and may include damages, contractual claims, protective measures and proceedings before competent regulatory or judicial authorities.

15. Cyber Insurance, Ransomware and Extortion Payments

Cyber insurance may transfer part of the financial exposure associated with incident response, forensic investigation, data restoration, business interruption and third-party liability. Coverage nevertheless depends on the policy wording, exclusions, notification conditions and security representations made by the insured. Ransomware presents additional legal complexity. A payment decision may require consideration of the recipient’s identity, sanctions, AML/CFT, criminal-law implications, insurance conditions, evidence preservation and regulatory coordination. It should therefore not be treated simply as a commercial decision about restoring systems. 16. Practical Cybersecurity Compliance Roadmap for Organisations. Cybersecurity compliance should begin with regulatory mapping, followed by a documented assessment of governance, risks, controls, incident readiness and external dependencies.

An organisation should be able to establish: which cybersecurity and sectoral rules apply; who is accountable at board, management and operational levels; whether material risks and critical assets are identified; whether incident escalation and evidence-preservation procedures work; which authorities and stakeholders may require notification; how cloud, vendor and cross-border risks are managed; and whether implementation can be demonstrated during an inspection. The objective is not identical controls for every organisation, but a risk-based, proportionate and demonstrable compliance framework.

17. How Bıçak Law Firm Supports Cybersecurity Compliance and Incident Response

Bıçak Law Firm advises domestic and international organisations on Türkiye’s cybersecurity regulatory framework and its interaction with data protection, corporate governance, contracts and sector regulation. Our support may include regulatory-scope and compliance assessments, cybersecurity governance reviews, incident-response and notification planning, technology and outsourcing agreements, third-party and cross-border data risk, regulatory engagement, internal investigations and cyber-related disputes. Where an incident has occurred, legal assistance may also involve coordinating regulatory and contractual obligations, supporting forensic teams from a legal perspective, preserving the organisation’s legal position and representing clients in related investigations, proceedings and disputes.

18. Frequently Asked Questions

18.1. What is Türkiye’s Cybersecurity Law?

Law No. 7545, enacted in March 2025, provides Türkiye’s principal horizontal statutory cybersecurity framework. It operates alongside data-protection, communications, internet, criminal and sector-specific legislation.

18.2. Who does Law No. 7545 apply to?

Its scope is broad and function-based. The precise obligations applicable to an organisation depend on its activities, regulatory status and, where relevant, critical-infrastructure role.

18.3. Does every company in Türkiye need a CISO?

No universal CISO requirement should be inferred for every private company merely because it operates in Türkiye. Specific organisational requirements may arise under sectoral or other applicable regulation.

18.4. Are penetration tests mandatory for every company?

Not universally. They may be mandatory in particular regulatory environments and may constitute appropriate security practice depending on the organisation’s risk profile.

18.5. When must a cyber incident be reported?

There is no single deadline for every cyber incident. Where Article 12(5) KVKK applies to a personal-data breach, notification to the Personal Data Protection Board must be made without delay and, under the Board’s interpretation, no later than 72 hours after awareness.

18.6. What is the Cybersecurity Presidency?

It is the central administrative authority established in January 2025 for Türkiye’s national cybersecurity policy, coordination and related statutory functions.

18.7. Does Türkiye require cybersecurity data to remain in Türkiye?

There is no universal localisation rule for all cybersecurity data. Personal-data transfers and sector-specific localisation or outsourcing requirements must instead be assessed separately.

18.8. Can the Cybersecurity Presidency audit private organisations?

Law No. 7545 provides supervisory and inspection powers within its scope. The extent of the requirements applicable to a particular private organisation depends on its status and activities.

18.9. Can directors be liable for cybersecurity failures?

Potentially, where the circumstances engage directors’ statutory duties and the conditions for liability are satisfied. The occurrence of a cyber incident alone does not establish director liability.

18.10. What should an organisation do after a serious cyber incident?

It should activate incident-response procedures, contain and assess the incident, preserve evidence and promptly determine applicable cybersecurity, regulatory, data-protection, contractual and insurance obligations.

19. Conclusion: From Compliance to Cyber Resilience

Türkiye’s cybersecurity regime has entered a new stage. Law No. 7545 supplied the legislative foundation in 2025; the Cybersecurity Presidency, Cybersecurity Board and operational compliance framework are shifting attention in 2026 toward implementation, auditability and resilience. The Board’s May 2026 designation of 15 critical infrastructure sectors and the Presidency’s current compliance and audit resources provide particularly visible evidence of that transition.

For organisations, cybersecurity can no longer be reduced to technical controls or post-incident response. It increasingly intersects with governance, regulatory compliance, data protection, critical infrastructure, third-party management and business continuity. The decisive question is therefore not simply whether an organisation has cybersecurity measures, but whether it can identify material risks, demonstrate proportionate controls, respond effectively and account for its decisions before regulators, courts, customers and other stakeholders. The progression from formal compliance to demonstrable cyber resilience is consequently becoming an essential component of responsible corporate governance in Türkiye.

…

At Bıçak Law Firm, we provide expert legal counsel on cybersecurity, data protection, and compliance strategies tailored to businesses operating in Turkey. For further guidance, feel free to contact us. 

For our latest announcement on this topic, you may also read about Prof. Dr. Vahit Bıçak’s contribution to the International Comparative Legal Guide – Cybersecurity 2026, where a ten-page analysis on Türkiye’s cybersecurity laws is freely accessible online: https://www.bicakhukuk.com/en/contribution-to-international-guide-cybersecurity/.