Türkiye did not have astandalone cybersecurity legal framework until very recently. The Cybersecurity Law, which came into force on 19 March 2025, laid the foundation for a comprehensive legal regime. Until the secondary regulations, which are to be adopted within one year, become effective, existing regulations will remain in force, provided that they are compatible with the Cybersecurity Law.

At present, cybersecurity is governed by a fragmented set of legal instruments and policy documents, as outlined below:

• The Constitution of the Turkish Republic (Constitution) indirectly addresses cybersecurity through article 20(3), which guarantees the right to the protection of personal data and article 22, which establishes the right to freedom of communication.