Cyber Security Law

Cyber Security Law is a legislation enacted to protect Türkiye’s digital infrastructure enhance the security of critical systems and implement effective measures against cyber threats. It was adopted on 12 February 2025 through a vote in the Grand National Assembly of Türkiye. The Law aims to strengthen the national cyber security framework by encompassing both public and private sectors under the coordination of the National Cyber Incident Response Team (SOME).

^{(Cyber Security Law Proposal adopted in the TBMM - Anadolu Agency )}

The main objectives of the Law are as follows:

• Establishing and implementing cyber security policies,

• Protecting critical infrastructure in the public and private sectors,

• Enhancing coordination with National Cyber Incident Response Teams (SOME),

• Creating mandatory reporting and oversight mechanisms,

• Developing effective response procedures against cyber attacks.

The Law mandates institutions operating in critical sectors such as energy finance, health, telecommunications and transportation among others to strengthen their cyber security measures.

Under the Law the National Cyber Incident Response Center (USOM) and National Cyber Incident Response Teams (SOME) play a critical role. Their responsibilities include:

• Detecting preventing and responding to cyber threats through SOME units in both public and private sectors,

• Enhancing national and international cooperation in cyber security,

• Mandating institutional reporting of cyber incidents to establish early warning systems,

• Raising cyber security awareness through regular cyber drills.

According to the Law all public and private sector institutions operating in critical sectors must report cyber security incidents to SOME as quickly as possible.

• Cyber attacks or security breaches must be reported to USOM within 24 hours.

• Institutions that fail to report or neglect cyber security measures will face severe administrative penalties.

The Law provides for substantial financial fines and operational sanctions against institutions that fail to implement the required cyber security measures:

• Institutions that fail to report cyber security vulnerabilities may be fined between 500,000 TL and 10 million TL.

• In cases where security weaknesses are identified in critical infrastructure sanctions such as suspension of operations or license revocation may be applied.

The Law also aims to align Türkiye with international cyber security standards. It anticipates increased international cooperation through information sharing with other countries joint security protocols and enhanced collaboration against digital threats.

The Cyber Security Law seeks to strengthen Türkiye’s digital infrastructure and make it more resilient to cyber attacks. Through regulations such as the protection of critical infrastructure coordination of SOME units mandatory reporting mechanisms and stringent penalties the country’s cyber security capacity is being significantly enhanced.