TurkeyElectronic Communications Network and Information Security Regulation, Breach and Interruption Notification
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://www.btk.gov.tr/uploads/pages/elektronik-habeles-me-sekto-ru-nde-s-ebeke-ve-bilgi-gu-venlig-i-yo-netmelig-i-5a341795a1773.pdfIn force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds the same operators as the Regulation's security-management row, authorized and regulated by the Information Technologies and Communications Authority (BTK) (reached by declaring that you provide telecom services).
- Notify the Authority as soon as possible of a network or information security breach that affects more than 5% of your subscribers and of any event that interrupts business continuity; the Regulation states no numeric clock (art. 38(1)).
- Include in the notification at least when the event occurred, its nature, its impact, its duration and the measures taken (art. 38(1)).
- Set up a reporting and feedback mechanism so that security breach events and vulnerabilities are reported as quickly as possible (art. 12(1)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Article 60(1) of Electronic Communications Law No. 5809 lets the Authority apply an administrative fine of up to three percent of an operator's net sales of the previous calendar year for violating the legislation; no per-article fine for this Regulation is stated.
- Rule
- Turnover pct only
- As of
- Turnover percentage cap
- 3
Who enforces it
Enforcement body
Bilgi Teknolojileri ve İletişim Kurumu (BTK), the Information Technologies and Communications Authority
Settledness
- As of
- Open questions
- Has the Regulation been amended or replaced since its publication on ?
What this law does
Article 38 requires an operator to notify the Authority as soon as possible of network and information security breaches affecting more than five percent of its subscribers and of events that interrupt business continuity. The notification must contain at least the time, nature, impact and duration of the event and the measures taken. Article 12 requires a reporting and feedback mechanism so that breaches and vulnerabilities are reported as quickly as possible.
Article 60 of Electronic Communications Law No. 5809 lets the Authority fine an operator up to three percent of its net sales of the previous calendar year for violating the legislation.
When LexLint raises it
When your app profile says your app provides telecom services.