Turkey: Media, Telecoms, IT, Entertainment

On 11 September 2026, reporting obligations under the Cyber Resilience Act (“CRA”) became applicable. Manufacturers must report actively exploited vulnerabilities and severe incidents affecting product security through the Single Reporting Platform. An early warning is due within 24 hours of becoming aware, followed by a fuller notification within 72 hours. Final reports are due within 14 days after a corrective measure becomes available for vulnerabilities and within one month after the 72-hour notification for severe incidents. The CRA’s main product requirements apply from December 2027.

The Regulation will take effect on 1 November 2026 and allows until 31 March 2027 for existing accounts, and as the relevant sanction provisions of Law No. 5651 will apply to breaches of its obligations, social network providers should review their registration flows, child accounts and objection processes before the effective date.

Turkey's Revenue Administration has issued a new communiqué expanding digital activity reporting obligations beyond e-commerce to encompass all digital platforms including internet-based buying, selling, leasing, advertising and listing activities. The regulation introduces new reporting requirements for various service providers including social network and location providers, while modifying identification information protocols and establishing monthly reporting deadlines through the BTRANS system.

On 6 September 2026, Türkiye’s Medium Term Programme (2027–2029) was published in Official Gazette No. 33362 (Duplicate Issue). Under the “Business and Investment Environment” policy area, the Programme identifies the completion of the process of aligning Personal Data Protection Law No. 6698 (“KVKK”) with the EU General Data Protection Regulation (“GDPR”) as a legislative and administrative measure targeted for the third quarter of 2027.

Turkey's Law No. 7590 fundamentally reshapes the country's digital regulatory architecture by transferring critical internet governance powers from the Information and Communication Technologies Authority to the newly empowered Cybersecurity Directorate. This institutional restructuring affects content removal, access blocking, domain name management, and lawful interception infrastructure, creating a centralized digital governance model. Businesses operating in electronic communications, hosting, social ne

Turkey's digital regulatory framework undergoes a major institutional restructuring as Law No. 7590 transfers critical internet governance powers from the Information and Communication Technologies Authority (BTK) to the newly empowered Cyber Security Presidency. This comprehensive reform consolidates authority over internet domain management, content blocking measures, and social media platform oversight under a single digital governance institution.

Rekabet Kurulu (“Kurul”), Paramount Skydance Corporation (“PARAMOUNT”) tarafından Warner Bros. Discovery Inc.’nin (“WARNER BROS”) tek kontrolünün devralınması işlemine, PARAMOUNT tarafından sunulan taahhütler çerçevesinde koşullu olarak izin verdi.

The European Commission has approved Paramount Skydance Corporation's acquisition of Warner Bros. Discovery, but only after securing significant commitments regarding film distribution partnerships in the European Economic Area. The decision addresses competition concerns in theatrical distribution markets, particularly focusing on Paramount's existing joint venture with Universal and the potential market concentration that would result from combining three major studios' distribution operations.

2464 sayılı Belediye Gelirleri Kanunu’nun 21. Maddesi uyarınca biletle girilen bazı yerlerde bilet bedeliyle birlikte aşağıdaki tarifeye göre eğlence vergisi alınmaktadır

Yönetmelik 1 Kasım 2026’da yürürlüğe girecek olup mevcut hesaplar için 31 Mart 2027’ye kadar süre tanımaktadır. Yükümlülüklere aykırılık hâlinde 5651 sayılı Kanun’un ilgili yaptırım hükümleri uygulanacağından sosyal ağ sağlayıcılarının kayıt akışlarını, çocuk hesaplarını ve itiraz süreçlerini yürürlük tarihinden önce gözden geçirmesi gerekmektedir

The Regulation will take effect on 1 November 2026 and allows until 31 March 2027 for existing accounts, and as the relevant sanction provisions of Law No. 5651 will apply to breaches of its obligations, social network providers should review their registration flows, child accounts and objection processes before the effective date.

Yönetmelik, 15 yaşını doldurmuş ancak 18 yaşını doldurmamış kullanıcılara, çocukların güvenliğini ve kişisel verilerini korumak amacıyla ayrıştırılmış hizmet sunulmasını zorunlu tutuyor. Bu kapsamda çocuk hesaplarının varsayılan olarak gizli tutulması ve kamuya açık hale getirilememesi, iletişim ve içerik önerisi özelliklerinin sınırlandırılması öngörülüyor.