"What is the cybersecurity law, and does it cover us?" is a question that companies' legal and information technology teams are asking more and more often. Cybersecurity Law No. 7545 (Siber Güvenlik Kanunu) sets out the duties, powers and responsibilities relating to cybersecurity in a single text, and it places direct responsibilities on companies that provide services through information systems.
In this article we summarize, from primary sources, when the Law was enacted, whom it covers, what obligations it places on companies, which type of sanction it provides for which acts, and the changes made in 2026. The steps to take during a cyber incident are covered in our article on incident response under the Cybersecurity Law; the focus here is scope and obligations.
When was the Law enacted?
The Law was adopted by the TBMM (the Turkish Parliament) on 12 March 2025 and published in issue No. 32846 of the Resmî Gazete (Türkiye's Official Gazette) dated 19 March 2025. Under Article 20 of the Law, it entered into force on the date of its publication. The institution responsible for implementation is the Siber Güvenlik Başkanlığı (Cybersecurity Presidency, referred to below as the Presidency), which is affiliated with the Presidency of the Republic. According to the Presidency's legislation page, the Presidency itself was established before the Law, by Presidential Decree No. 177 of 8 January 2025.
The Law's purpose and key concepts
Article 1 of the Law sets out its purpose as detecting and eliminating threats in cyberspace, determining the principles that will reduce the effects of cyber incidents, protecting institutions and individuals against cyberattacks, and establishing the Siber Güvenlik Kurulu (Cybersecurity Board).
Three of the definitions in Article 3 are especially important for companies:
- Cyber incident: A breach of the confidentiality, integrity or availability of information systems or data.
- Critical infrastructure: Infrastructures hosting information systems whose data, if its confidentiality, integrity or availability is disrupted, could cause loss of life, large-scale economic damage or a breakdown of public order.
- Critical public service: Services provided as a monopoly or with limited substitutability whose interruption could have a significant effect on national security, economic welfare or public order.
Among the principles in Article 4 is the provision that, alongside all public institutions, natural and legal persons are also responsible for taking the measures needed to prevent cyberattacks.
Whom does the Law cover?
According to the current text, Article 2 keeps the scope broad, covering public institutions, professional organizations with public-institution status, natural and legal persons, and entities without legal personality, in each case where they have a presence in cyberspace, carry out activities there or provide services there. Intelligence and military activities carried out under certain laws are outside the scope.
However, not every provision is intended to apply to everyone in the same way. Sub-paragraph (g) of Article 6 gives the Presidency the authority to classify those within the scope and, where necessary, to create provisions covering only a certain part of them. Some obligations, in turn, are written only for public institutions and critical infrastructures. Which provisions apply to a given company therefore depends on its activity and on the regulations the Presidency will issue.
Company obligations: Article 7
Article 7 of the Law lists, in five sub-paragraphs, the responsibilities of those within the scope who provide services through information systems or who collect or process data:
- (a) To provide, as a priority and on time, the data, information, documents, hardware, software and other contributions requested by the Presidency.
- (b) To take the measures required by the legislation, and to notify the Presidency without delay of the vulnerabilities and cyber incidents detected in the area where the service is provided.
- (c) To procure the cybersecurity products, systems and services to be used in public institutions and critical infrastructures from experts, manufacturers or companies authorized and certified by the Presidency.
- (ç) For cybersecurity companies subject to certification, to obtain the Presidency's approval before starting operations.
- (d) To fulfill the requirements of the Presidency's policies, strategies, action plans and other regulatory acts aimed at increasing cyber maturity.
We covered the practical side of the notification obligation in the incident response article linked above. If an incident also involves personal data, the obligations under Law No. 6698 (KVKK, Türkiye's data-protection law) must be assessed separately; for these, see our articles on KVKK data breach notification and company obligations under KVKK.
Audits and cybersecurity companies
Under Article 8, the Presidency may audit every kind of act and transaction within the scope of the Law. Audits may be carried out by Presidency personnel or by authorized independent auditors and audit organizations. Those subject to audit are obliged to keep the relevant devices, systems and software open to audit and in working order within the periods given.
There are also separate provisions for companies that produce cybersecurity products or services. Under Article 18, the sale of these products abroad is subject to procedures that the Presidency will determine; mergers, demergers and share transfers of these companies are notified to the Presidency, and transactions that result in a change of control are subject to approval. Under Provisional Article 1, companies operating in this field must complete their certification and authorization procedures within one year of the entry into force of the relevant regulations.
Sanctions: which article, which act?
The Law provides for two types of sanction. The amounts and durations are set out in the text of the Law; this article gives only the acts and the type of sanction.
Some of the acts for which imprisonment is provided (Art. 16):
- Failing to provide the information, documents, data or hardware requested by the competent authorities, or preventing it from being obtained (16/1; excluding public institutions).
- Carrying out activities without the approval, authorization or permission that the Law requires (16/2).
- Making previously leaked personal data or critical-public-service data accessible without authorization, sharing it, or offering it for sale (16/4).
- Producing or spreading false leak content, knowing that no leak has occurred, with the aim of creating panic or singling out a target (16/5).
Acts for which an administrative fine is provided:
- Failing to fulfill the responsibilities in sub-paragraphs (a), (b) and (c) of Article 7 and the obligations in Article 18 (16/10).
- Failing to fulfill the audit-related obligations in paragraph 4 of Article 8 (16/11); for commercial companies, this provision also sets out a calculation tied to annual gross sales revenue.
Under Article 17, a defense statement is obtained before an administrative fine is imposed, and decisions may be challenged before the administrative courts.
2026 amendments: Law No. 7590
According to the table in the Mevzuat Bilgi Sistemi (Türkiye's Legislation Information System), Law No. 7590 dated 24 July 2026 amended Articles 6 and 16 of Law No. 7545 with effect from 31 July 2026, and added Provisional Article 2 and a list of immovable property. The change that directly concerns companies is in 16/10: sub-paragraph (a) of Article 7, that is, the obligation to respond to the Presidency's requests for information and documents on time, has also been added to the scope of the administrative fine. A new sub-paragraph on providing technical facilities for lawful interception was added to Article 6.
Have the implementing regulations been issued?
Paragraph 6 of Provisional Article 1 states that the regulations on the implementation of the Law will be put into force within one year, and that until then the provisions of the existing regulations that do not conflict with the Law will continue to apply. In its announcement on the publication of the Law, the Presidency also includes the statement that implementation processes "will be put into effect in line with the secondary legislation work."
As of 26 October 2026, besides the Law and its establishing decree, the Presidency's legislation page lists only the Presidency's regulation on disciplinary superiors and two sets of procedures and principles on its own purchases of goods and services. No implementing regulation aimed at companies, whether on notification procedures, on the classification of those within the scope, or on the designation of critical infrastructures, appears to have been published in this list yet. To keep track, the Presidency's legislation page and the current text in the Mevzuat Bilgi Sistemi should be monitored.
Where to start?
The steps below are a general framework derived from the articles of the Law:
- Establish your position: Assess in writing whether the company provides services through information systems, and whether it supplies products or services to public institutions or to organizations that may qualify as critical infrastructure.
- Set up a request channel: Article 7/1-(a) is now covered by the administrative fine; decide who will respond to any information and document requests from the Presidency, and within what time.
- Write down the notification flow: Set out in a procedure to whom vulnerabilities and cyber incidents are reported internally, and who notifies the Presidency.
- Review your suppliers: Check the authorization status of the cybersecurity products and services used in public-sector or critical-infrastructure projects.
- Monitor the regulations: Regularly follow the secondary regulations that the Presidency will publish.
Frequently asked questions
When was the Cybersecurity Law enacted? It entered into force on 19 March 2025, upon its publication in the Resmî Gazete.
Are small companies also covered? Article 2 does not distinguish by size. However, the Presidency can classify those within the scope and apply some provisions only to certain groups.
Conclusion
Law No. 7545 keeps its scope broad, but how its obligations will apply company by company depends largely on the Presidency's secondary regulations, which have not yet been listed. From Orient Global's perspective, while waiting for the regulations, putting the information-request and incident-notification flows in writing now is the most concrete step that will speed up compliance, whichever regulation arrives.
Why logistics experience matters here. The steps above will look familiar to anyone who has run a distribution network. A request channel is an intake point with a named owner, a deadline and proof that the request was answered, much like the handling of a carrier query or a customs letter; a notification flow is the exception report that says who is told, by whom and how fast when a shipment goes wrong; and checking whether a cybersecurity supplier is authorized is the same qualification step that logistics applies to carriers and warehouse partners. Because warehouse, transport and order systems are what keep goods moving, they are a natural place to begin writing these flows down. One of our consultants brings more than 30 years in operations, logistics and supply chain: at a technology distribution company of roughly one billion dollars in scale, he ran logistics, warehousing, technical service and administrative operations end-to-end, building and leading teams of 100+ people and delivering lasting gains through KPI-driven programs. He has also managed nationwide warehouse and transport operations, large-scale distribution networks, and network and capacity planning at leading retail, logistics and distribution organizations. An industrial engineer, he now brings that supply-chain discipline to SMEs through AI and automation. Meet our consultants.
This article is for general information only and does not constitute legal or financial advice. For your own situation, consult your advisor.
#interimmanagement #forwarddeployedengineering