Cybersecurity regulation in Turkey (2026)

Turkey's first dedicated cybersecurity law was published in Official Gazette No. 32846, establishing the Cybersecurity Council, mandating transfer of BTK's cybersecurity functions to the new Cybersecurity Directorate within six months, and imposing sector-wide obligations — including asset inventories, risk assessments, and mandatory certification — on critical-infrastructure operators in energy, finance, health, and telecoms. Administrative fines range from TRY 1 million to TRY 100 million.

The Presidency created a standalone Cybersecurity Directorate as a public legal entity with financial autonomy, separating national cybersecurity execution from BTK and the Digital Transformation Office ahead of the March 2025 law. The Directorate will absorb all cyber-related assets and personnel from both bodies within six months of Law No. 7545.

Turkish officials admitted that names, ID numbers, addresses, and phone data for approximately 108 million citizens were stolen from government servers and stored in Google Drive files; BTK contacted Google to have the files removed. The incident directly catalyzed parliamentary passage of the 2025 Cybersecurity Law.

BTK activated a centralised automated platform to continuously track and audit public institutions' compliance with the 2020 Information and Communication Security Guide, marking a shift from self-reporting to real-time regulatory monitoring of the country's cyber hygiene posture.

Issued under Presidential Circular 2019/12, the Guide sets mandatory technical and administrative controls — encrypted server communications, domestic storage of sensitive national data (health, biometric, population records), and institutional email hosting in Turkey — applying to all public bodies and critical-infrastructure operators.

The third-generation national strategy introduced a proactive cyber posture, 24/7 critical-infrastructure protection, systematic risk analysis, and explicit targets to reduce dependency on foreign IT vendors — superseding the 2016–2019 plan and aligning with the 2023 national vision.

Turkey's GDPR-aligned data-protection law established the independent KVKK supervisory authority, imposed mandatory technical and administrative security controls on data controllers, and introduced breach-notification obligations — forming the principal data-security compliance layer that operates in parallel with sector-specific cybersecurity rules.

The second national strategy formalised objectives across cyber defence, critical-infrastructure protection, cybercrime deterrence, and human-capital development, and for the first time explicitly embedded cybersecurity targets within Turkey's 2023 national development vision.

Turkey deposited its instrument of ratification of the Council of Europe's Budapest Convention, the primary international treaty on cybercrime and electronic evidence, aligning Turkish substantive criminal law and mutual legal-assistance procedures with European standards.

The inaugural National Cybersecurity Strategy and Action Plan was approved by the newly formed Cybersecurity Board, and the National Cyber Incident Response Centre (USOM/TR-CERT) was stood up under BTK alongside sector-level Cyber Incident Response Teams (SOMEs) — creating the operational incident-response architecture that underpins today's framework.

Council of Ministers Decree No. 2012/3842, published in the Official Gazette on 20 October 2012, established the Cybersecurity Board as Turkey's first whole-of-government cybersecurity governance body and designated BTK as the national coordination authority — the foundational institutional act for all subsequent strategy and regulation.

Law No. 5651 on Regulation of Publications on the Internet established Turkey's legal framework for internet-based offences, imposing cooperation and data-preservation obligations on ISPs and enabling content blocking — the foundational statute on which successive cybersecurity and data-protection regulation was layered.