TurkeyTurkish Penal Code, Information System Crimes
Law No. 5237 (Turkish Penal Code), Arts. 243-244 (Bilişim Alanında Suçlar)
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not enter, or continue to unlawfully remain within, the whole or part of a computer system located in Turkey without authorisation.NIST AI RMFMAP 4.1
- Do not obstruct or disrupt a computer system's operation, or corrupt, destroy, alter, or render inaccessible the data it holds, or insert or transmit its data without authorisation, regardless of whether the data taken is personal.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Art. 244(1): obstructing or disrupting a computer system's operation carries imprisonment of one to five years. Art. 244(2): corrupting, destroying, altering, or rendering inaccessible data within a system, inserting data into it, or transmitting its data elsewhere carries imprisonment of six months to three years. Art. 244(3): the penalty for either offence is increased by half where committed against a bank, credit institution, or public institution's system. Art. 244(4): where the offender derives an unlawful benefit for self or another through these acts and no more serious offence is constituted, imprisonment of two to six years plus a judicial fine of up to 5,000 days applies. Art. 243(3): unauthorised entry that causes the system's data to be destroyed or altered carries imprisonment of six months to two years. Art. 243(4): unlawfully intercepting data transfers within or between systems by technical means without entering the system carries imprisonment of one to three years.
What it makes you log
Logging duty
Article 243 makes it an offence to enter or remain unlawfully in an information system, and article 244 punishes obstructing or disrupting a system and corrupting, destroying, altering or making data inaccessible. Neither article requires a log or record. The two articles carry no territorial clause of their own; the Code's general provisions on where its criminal law applies are not invoked by them.
- Kind
- None
- As of
What this law does
Article 243(1) criminalises unlawfully entering the whole or part of a computer system, or unlawfully continuing to remain there, an offence punishable by imprisonment or a judicial fine.
Where such entry causes the system's data to be destroyed or altered, Art. 243(3) sets imprisonment of six months to two years, and Art. 243(4), added in 2016, separately punishes unlawfully intercepting data transfers within or between computer systems by technical means without entering the system, at one to three years.
Article 244 punishes obstructing or disrupting a computer system's operation with imprisonment of one to five years (para. 1), and corrupting, destroying, altering, or rendering inaccessible the data within a system, inserting data into it, or transmitting its data elsewhere, with imprisonment of six months to three years (para. 2); the penalty is increased by half where a bank, credit institution, or public institution's system is affected (para. 3), and where the offender derives an unlawful benefit for self or another through these acts and no more serious offence is constituted, imprisonment rises to two to six years plus a judicial fine of up to 5,000 days (para. 4).
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .