Türkiye's Cybersecurity Law No. 7545 brings almost every organisation that operates or provides services in Turkish cyberspace under a single cyber security authority, with duties to hand over data on request, report incidents and vulnerabilities without delay, and, in some sectors, buy security products only from authorised suppliers. This guide explains who is in scope, what the authority can do, the obligations on organisations and on cyber security companies, and the penalties, then turns them into a practical compliance plan. It is written for security leaders, legal and compliance teams and international companies with Turkish operations. It complements the Turkey KVKK Guide, which covers personal data breach notification under Law No. 6698; this page covers the cyber security law only.
Source note: the official consolidated text on mevzuat.gov.tr and the Official Gazette site could not be accessed for this guide, so it is based on secondary sources: summaries by the law firms Köksal, CMS, Paksoy and LBF Partners. Each obligation is attributed to its source, and figures appear only where at least two independent sources agree. Confirm against the official text before relying on it.
Key takeaways
- In force since 19 March 2025. Law No. 7545 was published in the Official Gazette on 19 March 2025, issue 32846, and took effect on publication, according to Köksal and LBF Partners.
- Scope is broad. Public institutions, professional organisations with public institution status, and real and legal persons and entities without legal personality that operate or provide services in cyberspace are covered, not only critical infrastructure (Köksal, CMS).
- Report "without delay", with no fixed clock. Köksal reports that Article 7(1)(b) requires vulnerabilities and incidents to be reported without delay and sets no numeric deadline. Personal data breaches still follow the separate KVKK route.
- Authorised suppliers for public bodies and critical infrastructure. Köksal, Paksoy and LBF Partners all describe a duty for public institutions and critical infrastructure to procure cyber security products and services only from authorised or certified suppliers.
- Heavy penalties. Administrative fines run from TRY 100,000 up to TRY 100 million, with up to 5% of gross sales revenue for commercial companies that fail audit duties, and several offences carry prison terms.
Who and what the law covers
Köksal summarises Article 2 as covering public institutions, professional organisations with public institution status, and real and legal persons and unincorporated entities that exist, operate or provide services in cyberspace. It reports that intelligence activities under the laws governing the intelligence and security services are excluded. CMS describes the same scope, covering public and private entities operating or providing services in cyberspace.
The practical effect is that a multinational with Turkish subsidiaries, a cloud or SaaS provider serving Turkish customers and a domestic IT services firm can all receive requests from the authority. Critical infrastructure operators carry extra duties, especially on procurement and audits. Köksal and CMS both report that the Cybersecurity Board determines the critical infrastructure sectors, and Köksal reports that the Board determined fifteen sectors on 5 May 2026. Confirm your status against the official text and any sector decisions.
The authority and the Cybersecurity Board
The law is administered by the Siber Güvenlik Başkanlığı, translated as the Cybersecurity Directorate by Köksal and Paksoy and as the Cybersecurity Presidency by CMS and LBF Partners. Paksoy notes that the authority was set up by Presidential Decree shortly before the law was passed. A Cybersecurity Board chaired by the President of the Republic sets policy and strategy (Köksal, LBF Partners).
| Power or duty | What sources describe | Source |
|---|---|---|
| Information requests | Demand data, documents, hardware, software, product-generated data and log records | Köksal (Article 6), LBF Partners |
| Incident response | Respond to incidents on site or remotely, and oversee cyber incident response teams (SOME) | Köksal, CMS |
| Standards, testing and certification | Set cyber security standards and run testing and certification | CMS |
| Audits | Audit on site with its own staff or authorised independent auditors; audited entities must give access | Köksal (Article 8), CMS |
| Search and seizure | Search, copy and seize data and systems at non-public premises with a judicial order | Köksal (Article 8(5)), CMS |
Obligations on organisations
Köksal sets out the Article 7(1) duties as five items. Paksoy and LBF Partners describe the same duties without article numbers.
- (a) Provide information: supply requested data, documents, hardware or software promptly and as a priority. Paksoy describes the same duty as timely and with priority.
- (b) Take measures and report: take the measures the authority prescribes and report vulnerabilities and cyber incidents without delay. Köksal notes the law sets no numeric deadline; CMS also uses "without delay".
- (c) Use authorised suppliers: public institutions and critical infrastructure procure cyber security products and services only from authorised and certified suppliers.
- (ç) Approval before operating: cyber security companies subject to certification or authorisation obtain approval before starting operations.
- (d) Follow policy: implement the authority's policies, strategies and action plans.
Because "without delay" is not defined in hours, NHI Mgmt Group recommends treating it as a same-day escalation in your incident response plan, with a named owner who decides whether to notify and records the reasoning. Where an incident also involves personal data, the KVKK breach process runs in parallel; see the Turkey KVKK Guide. For how this sits alongside other national regimes, see the Cyber Incident Reporting Requirements Map.
Obligations on cyber security companies
The law also regulates the cyber security industry itself. Paksoy, CMS and LBF Partners describe these duties:
- Obtain approval before operating where certification or authorisation applies.
- Obtain export permission for controlled cyber security products (Paksoy; Köksal places export rules in Article 18).
- Notify the authority of mergers, spin-offs, share transfers or sales, and obtain prior approval for transactions that change direct or indirect control. Transactions that need approval and do not have it are legally void (Paksoy, CMS).
Paksoy reports that implementing regulations were due within one year of publication, and that companies then have one year from those regulations to complete certification and authorisation. Köksal reports the same structure under Provisional Article 1. Köksal reports that the one-year deadline for the regulations passed on 19 March 2026 and that, as of July 2026, no substantive implementing regulation had been published, so the compliance period had not started. Check whether the regulations have been published before planning around these periods.
Penalties
The figures below appear in at least two of the sources (Köksal, CMS, Paksoy, LBF Partners). Köksal notes that administrative fines are nominal 2025 figures revalued each year, so confirm current amounts.
| Conduct | Penalty | Type |
|---|---|---|
| Withholding requested information or obstructing the authority | 1 to 3 years' imprisonment | Criminal |
| Operating or transacting without a required approval | 2 to 4 years' imprisonment | Criminal |
| Breach of confidentiality obligations | 4 to 8 years' imprisonment | Criminal |
| Making data from a breach available without authorisation | 3 to 5 years' imprisonment | Criminal |
| Creating or spreading false content about a cyber security breach | 2 to 5 years' imprisonment | Criminal |
| Cyber attacks on Türkiye's national cyber power elements | 8 to 12 years' imprisonment | Criminal |
| Failing to report incidents or vulnerabilities, or to use authorised suppliers | TRY 1 million to TRY 10 million | Administrative |
| Breaching cyber security company duties such as approvals for transfers | TRY 10 million to TRY 100 million | Administrative |
| Failing to cooperate with audits | TRY 100,000 to TRY 1 million; for commercial companies up to 5% of gross sales revenue | Administrative |
Sources agree that penalties increase in aggravating circumstances, such as offences by public officials or organised activity. Köksal reports that Article 17 gives a written defence period before an administrative fine and a right of appeal to the administrative courts.
How to comply: a phased approach
This sequence is NHI Mgmt Group's recommendation, not a requirement of the law.
- Confirm scope and status. Record which Turkish entities and services operate in cyberspace and whether any are, or supply, critical infrastructure. Have Turkish counsel confirm against the official text.
- Name a contact and a request process. Decide who receives authority requests, who approves disclosure of data, logs and systems, and how fast you can respond. Requests can include log records, so know where they are held.
- Update the incident response plan. Add a decision step for notifying the authority without delay, alongside the KVKK breach notification route for personal data. Test it in a tabletop exercise. The Incident Response Plan Template can be adapted.
- Route vulnerability reports. Make sure vulnerabilities found internally or reported externally reach the person who decides on notification. See the Bug Bounty and Vulnerability Disclosure Guide.
- Check suppliers. If you are a public institution or critical infrastructure, review cyber security products and services against authorisation and certification once the lists exist, and add the requirement to contracts.
- Prepare for audits. Keep an inventory of systems, access paths and credentials, including service accounts and API keys used by suppliers, so you can give auditors access without improvising.
- Watch for secondary legislation. Track publication of implementing regulations and sector decisions and update the plan when they appear.
Mapping the law to your control framework
Most duties map to controls you may already run under NIST CSF 2.0. The mapping is our reading, for planning only.
| Law No. 7545 duty | CSF 2.0 | What to evidence |
|---|---|---|
| Know and meet legal requirements | GV.OC-03 | Legal register entry for Law No. 7545 with owner and review date |
| Report incidents without delay | RS.CO-02 | Notification decision records and timestamps |
| Report vulnerabilities | ID.RA-08 | Vulnerability intake and escalation records |
| Provide information and cooperate | RS.CO-03, RS.MA-01 | Request log, approvals and response times |
| Use authorised suppliers | GV.SC-05 | Contract clauses and supplier authorisation checks |
Common failure patterns
- Assuming only critical infrastructure is in scope: the information and reporting duties reach far wider.
- Treating KVKK and Law No. 7545 as one process: they have different authorities and triggers, and a single incident can trigger both.
- No owner for authority requests: a request for logs or systems arrives and nobody can approve a timely response, risking an obstruction offence.
- Unclear log locations: logs held by cloud and SaaS providers cannot be produced quickly.
- Relying on 2025 fine figures: fines are revalued yearly.
Practitioner checklist
- Record Law No. 7545 in the legal register with an owner and Turkish counsel contact.
- Confirm whether any entity is, or supplies, critical infrastructure.
- Name the contact and approval route for authority requests.
- Add a "without delay" notification decision to the incident response plan, separate from KVKK.
- Connect vulnerability intake to the notification decision.
- Know where logs, archives and data centres sit and how to give access.
- Add authorised supplier requirements to contracts where they apply.
- Track implementing regulations and sector decisions.
Standards and references
- Köksal: Cybersecurity Law No. 7545
- CMS: Türkiye adopts first cybersecurity law
- Paksoy via Mondaq: Turkish Cybersecurity Law Enters Into Force
- LBF Partners via Legal 500: Law No. 7545 on Cybersecurity Has Come Into Force
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Turkey KVKK Guide · Cyber Incident Reporting Requirements Map · Incident Response Plan Template. This guide summarises Türkiye's Cybersecurity Law No. 7545 from secondary sources and is not legal advice.