Provides telecom services, in Turkey

Elektronik Haberleşme Sektöründe Şebeke ve Bilgi Güvenliği Yönetmeliği (Resmî Gazete No. 29059, 13 Temmuz 2014), arts. 12 and 38 · Read the law's page

• Art. 12 binds an operator authorized and regulated by the Information Technologies and Communications Authority (BTK) (reached by declaring that you provide telecom services). The art. 38 notification, in the fourth part, binds operators of the listed authorization types at or above the annual net sales value the Board sets (art. 5(2)); under the Board decision of 10 March 2026 it applies to operators the Authority has authorized regardless of annual net sales.
• Notify the Authority as soon as possible of a network or information security breach that affects more than 5% of your subscribers and of any event that interrupts business continuity; the Regulation states no numeric clock (art. 38(1)).
• Include in the notification at least when the event occurred, its nature, its impact, its duration and the measures taken (art. 38(1)).
• Set up a reporting and feedback mechanism so that security breach events and vulnerabilities are reported as quickly as possible (art. 12(1)).

Elektronik Haberleşme Sektöründe Şebeke ve Bilgi Güvenliği Yönetmeliği (Resmî Gazete No. 29059, 13 Temmuz 2014), arts. 5, 6, 13 and 37 · Read the law's page

• This binds an operator authorized under the Electronic Communications Law that the Information Technologies and Communications Authority (BTK) regulates, including infrastructure operators, mobile and fixed telephone operators and internet service providers; the additional measures bind operators of the listed authorization types, and under the Board decision of 10 March 2026 they apply to operators the Authority has authorized regardless of annual net sales (arts. 1 and 5; reached by declaring that you provide telecom services).
• Take the basic network and information security measures of the third part of the Regulation, and set up an information security management system (BGYS) that covers all services of your authorization and your critical systems (arts. 5(1) and 6(1)).
• Audit the management system by internal audit, or have it audited, at least once every two years (art. 13(1)).
• If you are an operator bound by the additional measures (an operator of a listed authorization type, with no annual net sales condition under the Board decision of 10 March 2026), prepare a network and information security report each year by the end of March, keep it for 5 years, and give it to the Authority on request or at an audit (arts. 5(2) and 37(1), in the fourth part).

Law No. 7545 (12 March 2025), Art. 7 · Read the law's page

• This binds any entity that uses information systems to provide services, collect data, or process data within the Cybersecurity Law's own broad scope, with no revenue or user threshold gating this particular duty; a separate, narrower certification and export-approval duty binds only cybersecurity product and service vendors and is not raised here.
• Report a detected vulnerability or cyber incident in the area of service provided to the Cybersecurity Directorate without delay; the Law's own text sets no numeric reporting clock.
• Provide the Cybersecurity Directorate promptly with any data, information, document, hardware, software, or other contribution it requests in connection with its duties.
• Where cybersecurity products, systems, or services are procured for use in a public institution or in critical infrastructure, source them only from a provider the Directorate has certified or authorized.

Sosyal Açıdan Desteklenmesi Gereken Kesimlere Yönelik Tedbirlere İlişkin Usul ve Esaslar (Bilgi Teknolojileri ve İletişim Kurulu, 21.06.2018 tarihli ve 2018/DK-THD/190 sayılı Karar), m. 10(1), 2026/DK-THD/138 sayılı Kurul Kararı ile değişik · Read the law's page

• The Procedures name the Accessibility Checklist Level A and WCAG 2.2 without stating a WCAG conformance level: the duty is to base design on them (Procedures, Art. 10(1) as amended by Board Decision 2026/DK-THD/138).
• If you are an electronic communications operator that the Procedures bind, base the design of your websites and mobile applications on the Accessibility Checklist Level A and on the Web Content Accessibility Guidelines (WCAG 2.2) (Art. 10(1)).
• Report each quarter on the accessibility of your internet pages, giving the link under which the services you offer to disabled people are gathered under a single heading and the page's current level of accessibility, and on your smart-device applications, if you have any (Art. 10 and 11, quarterly reporting table).