TurkeyCybersecurity Law, Reporting and Cooperation Duties
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Security, Reporting
What it requires
- This binds any entity that uses information systems to provide services, collect data, or process data within the Cybersecurity Law's own broad scope, with no revenue or user threshold gating this particular duty; a separate, narrower certification and export-approval duty binds only cybersecurity product and service vendors and is not raised here.
- Report a detected vulnerability or cyber incident in the area of service provided to the Cybersecurity Directorate without delay; the Law's own text sets no numeric reporting clock.NIST CSF 2.0RS.CO-02
- Provide the Cybersecurity Directorate promptly with any data, information, document, hardware, software, or other contribution it requests in connection with its duties.NIST CSF 2.0RS.CO-03
- Where cybersecurity products, systems, or services are procured for use in a public institution or in critical infrastructure, source them only from a provider the Directorate has certified or authorized.NIST CSF 2.0GV.SC-06
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 16(10) enforces the Article 7(1)(a)-(c) duties raised here only by administrative fine. Elsewhere in the same Law, obstructing an authorized inspector's information request is punished by one to three years' imprisonment plus a judicial fine (Art. 16(1)), and a public official or a person who abuses a position of trust in connection with certain other offenses in the Law faces increased penalties; those provisions bind different conduct than the reporting, cooperation, and procurement duties described in this row.
Penalty structure
Art. 16(10) sets an administrative fine of 1,000,000 to 10,000,000 Turkish lira for failing the Art. 7(1)(a), (b), or (c) duties described in this row (cooperation, incident/vulnerability reporting, and certified-vendor procurement). The same subsection sets a separate, higher tier of 10,000,000 to 100,000,000 Turkish lira for failing the Art. 18 cybersecurity-product export and company-certification duties, which are not this row's duty and are not flagged on any declared activity.
- Rule
- Fixed only
- As of
- Currency
- TRY
- Fixed cap
- 10,000,000
Who enforces it
Enforcement body
Siber Güvenlik Başkanlığı (Cybersecurity Directorate), established under the Presidency by this Law
Settledness
- As of
- Open questions
- Have the implementing regulations this Law directs the Presidency to issue within one year of publication (due by ) been issued, and do they set a numeric clock for the Art. 7(1)(b) vulnerability/incident reporting duty?
- Law No. 7590 () added a new transitional article continuing the transfer of national cybersecurity functions and assets from the Information and Communications Technologies Authority (BTK) and the Telecommunications Communication Presidency to the Cybersecurity Directorate: has any amendment of this kind also changed Article 7's substantive duties?
What this law does
Article 7(1) of Turkey's Cybersecurity Law binds any entity that uses information systems to provide services or to collect and process data within the Law's scope. It must report a detected vulnerability or cyber incident to the Cybersecurity Directorate without delay. It must also supply the Directorate with any data or documentation the Directorate requests.
Where it serves public institutions or critical infrastructure, it must source cybersecurity products only from Directorate-certified providers. Failing the reporting, cooperation, or procurement duties in items (a) through (c) carries an administrative fine of 1,000,000 to 10,000,000 Turkish lira under Article 16(10); the Law's own text sets no numeric clock for the reporting duty itself.
A related item (ç) requires a certified cybersecurity company to obtain the Directorate's approval before beginning operations, a licensing duty that binds the narrower class of cybersecurity-product and service vendors rather than a general software or app developer, and is not itself covered by the Article 16(10) fine named above.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, runs an essential service, provides financial services, handles health records, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, is a listed company, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .