Obligations of Companies under the Cybersecurity Law

1. Introduction and General Framework of the Law

Cybersecurity has transcended being merely a technical matter and has become a critical field for the protection of public order, economic stability, and fundamental rights. With the widespread use of digital infrastructures, cyberattacks targeting information systems have reached a scale that may directly affect the security of individuals, institutions, and states. In parallel, numerous national and international legal and technical frameworks have been adopted to keep pace with these developments, and new legislative initiatives continue to be introduced dynamically.

In this context, the Cybersecurity Law No. 7545 (“Law”), published in the Official Gazette dated 19 March 2025 and numbered 32846, entered into force as the first comprehensive and binding legal instrument on cybersecurity in Türkiye. The Law imposes various technical and administrative obligations on all actors operating within both the public and private sectors.

The Law primarily aims to establish a common language in practice by clarifying key concepts. The Law defines the following terms:

• "Cybersecurity" refers to all activities aimed at protecting the confidentiality, integrity, and availability of information systems.
• "Cyberspace" refers to the environment created by digital systems and their users.
• "Cyber incident" refers to any threat or intervention targeting information systems.

The scope of the Law is notably broad, covering public institutions and organizations, professional bodies with a public legal status, as well as natural and legal persons, including unincorporated entities, that operate or provide services within cyberspace.

Pursuant to the Law, the Cybersecurity Authority ("Authority") has been established under the Presidency and has been granted regulatory, supervisory, risk analysis, and coordination powers. Additionally, the Cybersecurity Board (“Board”), tasked with determining national strategies and sectoral priorities, has also been reactivated.

The technical criteria that will guide implementation, audit procedures, and the details of certain obligations have not yet been determined. Secondary legislation addressing these aspects is expected to be issued within one year following the Law’s entry into force. This transitional period must therefore be closely monitored by companies to ensure their technical and managerial structures are duly aligned with the Law.

2. Main Obligations for Companies

Under Article 7 of the Law, legal entities that provide services or process data through information systems are subject to a broad set of responsibilities, ranging from technical infrastructure to administrative procedures.

• Obligation to Provide Information and Documents: Companies are required to submit any information, documents, data, and digital materials requested by the Authority in a timely and complete manner.


• Cybersecurity Measures and Incident/Vulnerability Reporting: Public institutions must take the necessary cybersecurity measures to safeguard national security, public order, and the continuity of public services, and promptly notify the Authority of any security incidents or vulnerabilities identified within their area of service.


• Cooperation with the Authority: Companies are obliged to implement the measures stipulated in the policies, strategies, and action plans developed by the Authority and to cooperate when required. This obligation also includes making an effective contribution to the coordination of national cybersecurity efforts.


• Use of Certified Products and Employment of Experts: Public institutions and organizations operating in critical infrastructure sectors are required to procure cybersecurity products and services exclusively from individuals or companies authorized by the Authority. The export of cybersecurity products, systems, software, hardware, and related services is subject to the prior approval of the Authority. Companies developing such products and services must notify the Authority in the event of mergers, demergers, share transfers, or sales. Where such transactions result in sole or joint control or decision-making authority over the company, prior approval of the Authority must be obtained.


• Prohibition of Unauthorized Activities: Companies seeking to engage in cybersecurity activities within areas subject to certification or authorization must obtain prior approval from the Authority before commencing operations. Otherwise, they will be subject to sanctions for unauthorized activities.


• Compliance Obligation: Companies are required to act in compliance with the principles, security standards, and regulatory documents to be published by the Authority.


• Audit Availability: The Authority may, when deemed necessary, audit the information systems and security measures of companies with respect to any acts or transactions falling under Article 8 of the Law. Furthermore, for reasons of national security, public order, or the prevention of cybercrime, searches, copying, and seizures may be conducted in private premises (such as residences, workplaces, and non-public areas) under certain conditions—either by court order or, in cases of urgency, by written order of the public prosecutor. For public institutions and organizations, a court order will not be required; however, for authorized data center operators, such actions may only be carried out with a court order. Following such audits, the Authority may require companies to remedy identified deficiencies and implement additional security measures.

3. Liabilities and Sanctions

The Law not only imposes technical and compliance obligations but also establishes significant sanctions applicable to institutions, company executives, and other natural persons. These sanctions, which may be criminal or administrative in nature, vary depending on the characteristics of the relevant act.

Criminal provisions and administrative fines are regulated under Article 16 of the Law. Accordingly, those who fail to provide the information, documents, hardware, or software requested by the Authority or who obstruct audits shall be subject to imprisonment ranging from one to three years. Those engaging in activities without obtaining the necessary permits or authorizations may be subject to imprisonment ranging from two to four years.

As for administrative fines, companies that violate the provisions of the Law may be liable to an administrative fine ranging from one million to ten million Turkish lira per violation.

Article 17 of the Law sets out the procedures for imposing administrative fines. An administrative fine cannot be imposed without obtaining the defense of the relevant person or entity; however, if the defense is not submitted within thirty days, this right shall be deemed waived. In cases where the same offense is committed repeatedly, the fine may be increased, and if the act causes damage or results in a benefit, the fine may be determined at three to five times the amount of such damage or benefit. Decisions imposing administrative fines may be appealed before the administrative courts.

As demonstrated, these provisions establish a liability regime encompassing not only the technical infrastructure of companies but also their managerial processes. It is therefore of critical importance for executives to duly fulfill their duty of care regarding the companies’ cybersecurity obligations to avoid exposure to potential sanctions.

4. Conclusion and Compliance Recommendations

The Law requires a fundamental change in companies' approach to cybersecurity. Cybersecurity has expanded beyond the responsibilities of technical teams alone and has become a critical compliance matter that must be overseen strategically by the board of directors. The regulations introduced by the Law require companies to be prepared not only against cyberattacks but also for inspections and audits conducted by public authorities. Accordingly, until secondary legislation is enacted, it is crucial for companies to take proactive measures and develop a risk-based security strategy.

To prevent or mitigate risks in practice, companies should first:

• Review their internal operational audit processes and identify any gaps regarding regulatory compliance. It is recommended to develop comprehensive checklists that regularly assess compliance and monitor all corporate and managerial processes accordingly.


• Prepare and maintain an up-to-date cybersecurity incident response plan that clearly defines internal responsibilities, emergency action protocols, and technical and communication procedures, ensuring rapid and appropriate responses to potential security vulnerabilities or incidents.


• Maintain an up-to-date inventory of IT assets, including hardware, software, and information systems, with particular attention to monitoring critical systems.
• Conduct regular penetration tests on information systems and establish a log management infrastructure to ensure internal security and to demonstrate technical adequacy during potential audits by the Authority.


• Provide regular cybersecurity awareness training for all employees, measuring participation and effectiveness, to ensure that every department is adequately prepared for potential audits.


• Assess suppliers and third-party service providers in terms of cybersecurity obligations and explicitly define these obligations in contracts.
• Appoint a dedicated officer responsible for monitoring compliance with cybersecurity regulations and liaising with the Authority, to ensure the effective implementation of necessary processes.


• Periodically report cybersecurity compliance status to the board of directors, which is critical for early risk detection and timely preventive actions. Implementing these measures will reduce both operational and legal risks for companies.

It should be emphasized that, since the precise implementation details have not yet been finalized, secondary regulations and audit practices issued by the Authority will determine the system’s boundaries and the interpretation of relevant provisions. Therefore, during this period of uncertainty, companies must proactively review their preparations to ensure timely and effective compliance with the Law’s requirements.

The responsibilities introduced by the Law should be viewed not merely as obligations but also as opportunities to strengthen corporate security, reduce reputational risks, and enhance financial stability and corporate value. Accordingly, companies that manage their cybersecurity processes systematically, as they did with personal data protection, will not only fulfill their legal obligations but also preserve long-term competitive advantage and increase their corporate value. Otherwise, companies caught unprepared may incur costs beyond administrative fines, including audit findings, reputational damage, and operational disruptions, which could result in significantly more severe consequences.


Eylül Bengisu Gümüş, Senior Associate
Nejan Yılmaz, Associate