Cyber law in Turkey is not one statute: there is no single cyber code, and four laws apply at once to anyone who processes data, runs a platform or operates systems that reach Turkish users. The Personal Data Protection Law (KVKK) governs personal data and its transfer abroad; the Turkish Penal Code defines the computer offences; the Internet Law regulates online content, hosting and social networks; and the Cybersecurity Law of 2025 adds a national cybersecurity authority with incident-reporting duties. This article explains which authority enforces each, what the KVKK requires of a controller and how the 2024 amendment changed cross-border transfers, how a data breach is notified within seventy-two hours, which computer offences the Penal Code punishes and how they are investigated, how content is removed and what a social network provider must do, and what the 2025 law requires of companies, with the points that matter to foreign companies and platforms serving Turkey from abroad.
- The Personal Data Protection Authority, the Information and Communication Technologies Authority, the Cybersecurity Presidency and the public prosecutor each enforce a different statute.
- Since September 2024, data leaves Turkey under an adequacy decision, a safeguard such as a standard contract notified to the Board within five business days, or a narrow exception; explicit consent is no longer the routine basis.
- A data breach is notified to the Board within seventy-two hours of the controller learning of it; fines are revalued each year and appeals go to the administrative courts.
- Unauthorised access, system interference, data interference and payment card offences are prosecuted without a complaint and investigated with digital evidence seized under a judge's order.
- Content is removed or blocked through the criminal judgeship of peace within twenty-four hours; a social network with more than a million daily users needs a representative in Turkey.
The statutes and the authorities: which law applies to what
The first question in any Turkish cyber matter is which statute governs it, because the authorities, the procedures and the penalties differ. The Personal Data Protection Law (Kişisel Verilerin Korunması Kanunu, KVKK), in force since 2016 and substantially amended in 2024, governs the processing of personal data by any controller and is enforced by the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) through administrative fines, orders and public announcements. The Turkish Penal Code (Türk Ceza Kanunu) contains the computer offences and the personal data offences, prosecuted by the public prosecutor and tried in the criminal courts. The Internet Law (the law on the regulation of online publications, known by its number 5651) governs content, hosting, access and social network providers and is enforced by the Information and Communication Technologies Authority (Bilgi Teknolojileri ve İletişim Kurumu, BTK) and the criminal judgeships of peace. The Cybersecurity Law of March 2025 created the Cybersecurity Presidency (Siber Güvenlik Başkanlığı) with audit and sanction powers over anyone active in cyberspace.
Around these four sit the sector regulators, each with its own information security rules: the Banking Regulation and Supervision Agency for banks and payment institutions, the Capital Markets Board for investment firms, the Energy Market Regulatory Authority, the Ministry of Health for health data systems and the BTK itself for telecommunications operators. A fintech company therefore answers to the KVKK for its customers' data, to the banking regulator for its information systems, to the Penal Code if it is attacked and to the Cybersecurity Presidency for incident reporting, and the obligations overlap rather than replace one another. Our practice page on the information technology lawyer in Turkey covers the sector rules; this article covers the general framework.
Foreign companies are reached in two ways. The KVKK contains no territorial clause, but in practice the Board applies it to any controller, wherever established, that processes the data of persons in Turkey, and a controller resident abroad must register with the data controllers' registry through a representative in Turkey regardless of its size; the Internet Law applies to any platform accessed from Turkey, and its social network obligations are triggered by the number of daily users in Turkey, not by the company's seat. Turkey has also been a party to the Council of Europe Convention on Cybercrime, the Budapest Convention, since the beginning of 2015, so a cross-border cybercrime investigation runs through the Convention's preservation and mutual assistance channels. Our note on Interpol Red Notices and extradition in Turkey covers the criminal cooperation side.
Personal data under the KVKK: lawful grounds, the registry and data subject rights
Personal data is any information relating to an identified or identifiable natural person, and processing covers every operation on it, from collection to deletion. A controller processes on one of the lawful grounds the KVKK lists: explicit consent, express provision in a law, necessity for a contract with the data subject, the controller's legal obligation, data made public by the data subject, the establishment or protection of a right, or the controller's legitimate interest where it does not harm the data subject's fundamental rights. Special categories, which include health, biometric and genetic data, religion, ethnic origin, criminal convictions and sexual life, had until 2024 almost no lawful ground other than explicit consent; the 2024 amendment added grounds that mirror the general ones, including processing by persons under a duty of confidentiality and processing necessary for employment, occupational health and safety and social security, which resolved the long-standing problem of employers who could not lawfully hold their staff's health records.
Every controller informs data subjects at the time of collection, through a privacy notice (aydınlatma metni) stating the controller's identity, the purposes, the recipients, the legal ground and the data subject's rights, and answers a data subject's request within thirty days. The data controllers' registry (Veri Sorumluları Sicil Bilgi Sistemi, VERBİS) is where a controller declares its processing categories, purposes, recipients, retention periods and security measures before it starts processing. Under the Board's current threshold decision, companies with fewer than fifty employees and an annual balance sheet total below one hundred million lira are exempt, unless their main activity is processing special category data; controllers established abroad register through a representative in Turkey whatever their size, and in filings we handle the missing foreign registration is the most common finding when a group audits its Turkish subsidiary.
A data subject may complain to the Board only after applying to the controller first, and the Board's remedies are an order to the controller, a public announcement and an administrative fine. The fine brackets are revalued every year; failure to register with the registry alone carries a 2026 bracket whose upper limit exceeds seventeen million lira. Since June 2024 a fine is challenged before the administrative courts, not the criminal judgeship of peace, which has turned KVKK enforcement into ordinary administrative litigation with full review of the facts. Practice may vary by authority and year.
Cross-border data transfers after the 2024 amendment
Until 2024 a transfer of personal data abroad required either explicit consent or the Board's permission, and because permissions were rarely granted, consent became the universal basis, including for payroll, cloud storage and group reporting. The amendment of March 2024, applicable to transfers since September 2024, replaced this with a three-tier structure modelled on the GDPR. The first tier is an adequacy decision by the Board for a country, a sector or an international organisation; as of the Authority's January 2025 guideline the Board had published no adequacy decision, so the first tier existed on paper only. The second tier is an appropriate safeguard: an agreement between public bodies with the Board's permission, binding corporate rules approved by the Board for intra-group transfers, a standard contract in the form the Board has published, or a written undertaking approved by the Board.
The standard contract is the instrument most companies use. It is signed between the exporter and the importer in the Board's template, without changes to its clauses, and notified to the Authority within five business days of signature; failure to notify is itself fined, in a bracket that in 2024 ran from fifty thousand to one million lira. Onward transfers by the importer, and the sub-processors it uses, are listed in the contract's annexes and later changes are notified. The third tier is a set of exceptions available only where no adequacy decision and no safeguard exists and only for occasional transfers: explicit consent given after information about the risks, performance of a contract with the data subject, an important public interest, the establishment or defence of a legal claim, the protection of life, or data from a public register. Consent therefore remains available, but only as the last resort and not for routine flows.
The Regulation on transfers of July 2024 and the Authority's guideline of January 2025 fill in the detail, including the content of binding corporate rules and the notification procedure. In our practice a group with a Turkish subsidiary now signs standard contracts for HR, CRM and IT support flows, notifies each within the five business days, and maps the sub-processors, because a transfer without a safeguard is an unlawful transfer regardless of what the employee or customer consented to. A transfer that merely passes through foreign servers counts as a transfer, so a Turkish company using a foreign cloud service is an exporter even if its customers are all in Turkey. Our practice page on the commercial contract lawyer in Turkey covers data processing and transfer agreements.
Data breaches: the seventy-two-hour notification and the Board's response
A controller that learns that personal data has been obtained by unauthorised persons, whether through an attack, an employee's misconduct, a misdirected e-mail or a lost device, notifies the Board without delay and at the latest within seventy-two hours of learning of it, under a Board decision of January 2019 that fixed the period, and informs the affected data subjects as soon as reasonably possible by direct communication or, where that is impossible, by a notice on its website. The notification is made on the Board's breach form and states the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken and the contact person; where the facts are not yet known, the form is filed within the seventy-two hours and completed later, because the deadline is for the first notification, not the final report.
The Board publishes a summary of most notified breaches on its website, naming the controller, which for a foreign company is often the first public mention of the incident in Turkey, and it opens an examination that asks whether the technical and organisational measures required by the KVKK were in place before the breach. The fine, when imposed, is for the security failure rather than for the breach itself, so a controller with documented access controls, encryption, logging and staff training is treated differently from one without, and the examination also asks whether the notification was late, which is a separate ground. In filings we handle, the breach response runs in parallel on three tracks: the forensic investigation that establishes what was taken, the KVKK notification and the data subject communication, and the criminal complaint to the prosecutor for the computer offence.
A processor that suffers the breach has no direct notification duty to the Board, but informs the controller without delay under the processing agreement, and the controller's clock starts when the controller learns of the breach. A breach with a Turkish component in a group governed by the GDPR produces parallel notifications under both regimes, with different forms and different authorities, and the content of the two must agree. Civil claims by data subjects for pecuniary and non-pecuniary damage follow the general tort rules and rest on the controller's security failure, so the Board's findings are read with the later litigation in mind. Practice may vary by authority and year.
Cybercrime under the Penal Code: offences, penalties and the investigation
The Penal Code's computer offences are four. Unlawful access to an information system, or remaining in it, carries imprisonment of up to one year or a judicial fine, reduced where the system is available against payment and raised to six months to two years where data is destroyed or altered as a result; monitoring data transfers within a system or between systems without entering it, added in 2016, carries one to three years. Obstructing or disrupting the operation of a system carries one to five years, and destroying, altering, corrupting or rendering inaccessible data, or placing data in a system, six months to three years, both increased by half where the system belongs to a bank, a credit institution or a public body, and rising to two to six years with a judicial fine where the offender obtains an unjust benefit and no other offence is made out. Using another person's bank or credit card or its data without consent carries three to six years and a judicial fine, producing a counterfeit card three to seven years, and using one four to eight years; making or possessing devices or programs for these offences carries one to three years.
Alongside these sit the personal data offences: unlawfully recording personal data carries one to three years, unlawfully disclosing, transferring or obtaining it two to four years, and failing to destroy data when the law requires it one to two years, with increases where the data is special category or the offender is a public official or abuses a profession. None of the computer offences requires the victim's complaint, so the prosecutor investigates on notice and the file does not close because the parties settle, and they are outside the reconciliation procedure. A legal person for whose benefit an offence is committed faces the security measures the Code provides for companies, including the revocation of licences and confiscation, alongside the individual prosecution of the persons who acted.
The investigation turns on digital evidence. Under the Criminal Procedure Code, a computer, program or file is searched, copied and analysed on a judge's decision, and in cases of urgency on the prosecutor's written order, with a forensic image taken and its hash recorded so that the copy can be verified; the device is returned once the image is made unless it is itself evidence. The Cybercrime Department of the General Directorate of Security and the forensic units of the Council of Forensic Medicine produce the technical reports, and a copy of the image is given to the suspect or their lawyer on request. A foreign victim files the complaint with the prosecutor through a lawyer under a power of attorney, attaching the logs and the bank records, and joins the proceedings as a participant to claim damages; a foreign suspect is subject to the ordinary rules on detention and judicial control. Our practice page on the criminal lawyer in Turkey covers the procedure.
Online content, platforms and social networks under the Internet Law
The Internet Law divides the actors into content providers, who produce or publish the content, hosting providers, who store it, access providers, who carry it, and, since 2020, social network providers. A hosting provider is not obliged to monitor what it hosts, but must remove unlawful content when a judge or court so orders, within twenty-four hours, and keeps traffic records for the period the law prescribes; a content provider answers for its own content. Blocking and removal orders rest on three grounds. For the catalogue offences, which include child sexual abuse material, obscenity, prostitution, gambling, drugs and the encouragement of suicide, the criminal judgeship of peace orders blocking or removal, and the BTK may act directly in some cases. For a violation of personal rights, the person affected may ask the content or hosting provider to remove the content or apply directly to the criminal judgeship of peace, which decides within twenty-four hours without a hearing; the decision is sent to the Access Providers Association (Erişim Sağlayıcıları Birliği), which has the access providers implement it within hours. For a violation of private life, the BTK may block on the applicant's request and submits the decision to the judge for confirmation within a day.
The 2020 amendment created the social network provider, a platform on which users create, view or share content for social interaction, and attached obligations to those with more than one million daily accesses from Turkey: a representative in Turkey, who must be a Turkish citizen if a natural person, notified to the BTK and shown on the platform; a response to personal rights and privacy applications within forty-eight hours; a report to the BTK every six months on removal requests and decisions; and storage of Turkish users' data in Turkey. The sanctions for a missing representative escalate from fines through a ban on Turkish advertisers to a court-ordered reduction of bandwidth by half and then by ninety percent, and the sequence has been applied to major platforms. The 2022 amendment added, for providers above ten million daily accesses, a duty to give the prosecutor the information needed to identify users suspected of listed offences, with bandwidth reduction and fines of up to three percent of global turnover as the sanction, and brought online news sites under the Press Law.
The 2022 amendment also created the offence of publicly disseminating misleading information about the country's security, public order or health with the intent to cause fear or panic, punishable by one to three years' imprisonment, which has been challenged before the Constitutional Court and remains contested; a foreign platform does not commit it, but receives the removal orders and the user identification requests that follow from it. Practice before the criminal judgeships of peace is uneven: the same content may be blocked by one judgeship and left by another, the decisions are reviewed only by the neighbouring judgeship, and the Constitutional Court has repeatedly found blocking orders to violate freedom of expression, so an individual application is part of the strategy for a publisher. Our practice page on the advertising and media lawyer in Turkey covers content disputes and platform compliance.
The 2025 Cybersecurity Law and the sector regulators
The Cybersecurity Law, published in March 2025 and in force since, is the first general cybersecurity statute and applies to public bodies, companies and individuals that have a presence, operate or provide services in cyberspace, which is to say almost every business. The Cybersecurity Presidency, created by presidential decree in January 2025 and attached to the Presidency of the Republic, sets policy and standards, designates the critical infrastructure operators within the sectors the Cybersecurity Board has listed, authorises and certifies cybersecurity providers, and audits compliance; the Cybersecurity Board adopts the strategy and designates the sectors, which include energy, finance, electronic communications, transport, health, water, digital infrastructure and services, and the defence industry. The National Cyber Incident Response Centre (USOM) and the sectoral and institutional response teams (SOME) remain the operational layer.
The obligations fall on everyone within scope. A company supplies the data, documents, hardware and software the Presidency requests, on a priority basis, and cannot refuse on the ground of its own confidentiality rules; it takes the measures the Presidency prescribes and reports vulnerabilities and cyber incidents to the Presidency without delay, with no fixed deadline; public bodies and critical infrastructure operators procure cybersecurity products and services from providers the Presidency has authorised or certified; and a cybersecurity company needs the Presidency's approval before operating, before selling its products abroad and before a merger, demerger or share transfer that changes control, which is void without it. The Presidency may inspect on site, examine systems and take copies, and a search needs a judge's decision or, where delay would be harmful, the prosecutor's written order.
The sanctions are both criminal and administrative. Failing to supply requested information or documents carries one to three years' imprisonment and a judicial fine; making personal data or critical public service data obtained from a breach available to others without authorisation carries three to five years; creating or spreading false content about a breach to cause public fear or to target a person or institution carries two to five years; and operating without a required approval or authorisation carries two to four years. Administrative fines run from one hundred thousand to one hundred million lira depending on the duty breached, with the audit-obstruction bracket rising for commercial companies to five percent of gross sales revenue. The secondary legislation is still being issued, and the sector regulators' own rules, in particular the banking regulator's regulation on information systems and the BTK's rules for operators, continue to apply alongside the new law; a company subject to both reports an incident to both. Our practice page on criminal law in Turkey covers the new offences.
Frequently asked questions
- Does the KVKK apply to a foreign company with no office in Turkey? In practice yes, where it processes the data of persons in Turkey, and a controller resident abroad must register with the data controllers' registry through a representative in Turkey regardless of its size; the Board has fined foreign companies for failing to do so.
- Can we still transfer data abroad on the basis of consent? Only as an exception for occasional transfers where no adequacy decision and no safeguard exists. Routine flows such as payroll, cloud hosting and group reporting need a safeguard, in practice the Board's standard contract notified within five business days of signature.
- What is the deadline to report a data breach? Seventy-two hours from the controller learning of the breach, on the Board's form, with the data subjects informed as soon as reasonably possible; an incomplete first notification within the deadline is completed later.
- Which computer offences does the Penal Code punish, and are they prosecuted without a complaint? Unlawful access to a system, obstructing a system, destroying or altering data, misusing bank and credit cards and making tools for these offences, plus the unlawful recording, transfer or non-deletion of personal data. All are prosecuted by the prosecutor on notice and are outside the reconciliation procedure.
- How is defamatory or private content removed from a Turkish website or a platform? By a request to the content or hosting provider, or an application to the criminal judgeship of peace, which decides within twenty-four hours without a hearing; the Access Providers Association implements the order, and the judge may also order search engines to delist the applicant's name from the results.
- What must a social network do to operate lawfully in Turkey? Above one million daily accesses from Turkey: appoint a representative in Turkey, answer personal rights and privacy applications within forty-eight hours, report to the BTK every six months and store Turkish users' data in Turkey; above ten million, also identify users to the prosecutor for listed offences. Sanctions escalate from fines to advertising bans and bandwidth reduction.
- Does the 2025 Cybersecurity Law apply to an ordinary company? Yes. Any company with a presence or activity in cyberspace must supply information the Cybersecurity Presidency requests, take the measures it prescribes and report incidents and vulnerabilities without delay; procurement and authorisation duties apply to public bodies, critical infrastructure operators and cybersecurity companies.
Author: Av. Mirkan Günay Topcu, Managing Partner, ER&GUN&ER Law Firm, Istanbul Bar No. 67874. He advises foreign companies, platforms and individuals on KVKK compliance, cross-border data transfers, data breach response, computer and personal data offences, content removal and social network obligations in Turkey. Education: Istanbul University Faculty of Law (2018); Galatasaray University, LL.M. (2022).
Profile: Av. Mirkan Günay Topcu. LinkedIn: Profile. Istanbul Bar Association: Official website. Related practice page: intellectual property lawyer in Turkey.