- with Inhouse Counsel
- with readers working within the Aerospace & Defence industries
May 2026 – April 2026 brought significant developments across different areas of technology law and digital regulation in Türkiye. Key updates included the Competition Authority’s sector inquiry into AI, new compliance obligations introduced for social network providers and gaming platforms under the Internet Law, the publication of the Nuclear Facilities Cybersecurity Regulation, and the release of the Turkish DPA’s 2025 Activity Report.
In this edition of Quick Read, we highlight the most notable recent developments in data protection, cybersecurity and digital regulation in Türkiye.
Developments in AI
Turkish Competition Authority Launches AI Sector Inquiry
On 7 April 2026, the Turkish Competition Authority announced the launch of a sector inquiry into AI technologies. The Authority noted that rapid developments in AI, particularly generative AI systems, are reshaping market dynamics and have the potential to fundamentally alter how competition is established and maintained in digital markets.
According to the announcement, the inquiry will focus on:
- the structure of the AI value chain;
- access to critical inputs such as data and computing power;
- vertical integration strategies adopted by major technology companies;
- relationships between large technology undertakings and innovative start-ups; and
- the impact of AI integration within digital platform ecosystems.
AI Copyright Proposal Submitted to Parliament
A legislative proposal introducing AI-related copyright rules was submitted to the Turkish Grand National Assembly in April 2026. The proposal aims to regulate the use of copyrighted materials in AI training processes and certain commercial uses of AI-generated outputs.
If enacted, the proposal would introduce:
- licensing requirements for the use of copyrighted works in AI training, testing, fine-tuning, and data mining activities;
- licensing obligations for certain commercial uses of AI-generated outputs that compete with original copyrighted works; and
- a centralised collective licensing structure under a single licensing organisation.
Developments in Cybersecurity
Sector-Specific Cybersecurity Rules Introduced for Nuclear Facilities
Türkiye’s Nuclear Regulatory Authority has published the Regulation on Cybersecurity in Nuclear Facilities, establishing a dedicated cybersecurity framework for nuclear facilities operating in Türkiye. The regulation introduces obligations concerning:
- cybersecurity governance
- digital asset management
- risk management
- configuration management
- incident response planning
- supply chain security
- vulnerability management
- personnel awareness and training
The new framework adopts key cybersecurity principles, including defence-in-depth and risk-based approaches. Under the Regulation, nuclear facility operators are required to:
- establish dedicated cybersecurity architectures;
- conduct periodic cybersecurity risk assessments;
- implement incident response plans;
- maintain cybersecurity monitoring systems; and
- report cyber incidents to the relevant authorities without delay.
The Regulation also mandates annual cybersecurity audits, vulnerability management programs, backup and disaster recovery systems, and regular cybersecurity awareness training for personnel. In addition, cyber incidents affecting nuclear facilities must be immediately reported to both the Nuclear Regulatory Authority and the Cybersecurity Presidency.
Cybersecurity Operation Against Illegal Data Query Systems
In April 2026, Turkish authorities carried out a large-scale cybersecurity operation coordinated by the National Intelligence Organisation (“MIT”), the Cybersecurity Presidency, the Gendarmerie General Command, and the Financial Crimes Investigation Board (MASAK).
According to publicly available statements:
- approximately 40 illegal systems enabling unlawful personal data queries were shut down;
- forensic examinations identified large volumes of personal data and user records;
- financial investigations revealed transaction volumes of approximately TRY 177 million (approx. EUR 3.3 million) ; and
- suspects allegedly used offline cryptocurrency wallets to avoid financial traceability.
Developments in Digital Regulation
New Age-Gating and Compliance Obligations Introduced for Social Networks and Gaming Platforms
Recent amendments to the Internet Law introduce significant new obligations for social network providers and gaming platforms operating in Türkiye. The amendments aim to strengthen child protection measures and increase regulatory oversight over digital platforms.
Under the new framework:
- social network providers may no longer provide services to children under the age of 15;
- providers will be required to implement age verification mechanisms;
- differentiated services must be introduced for users above the age of 15;
- parental control tools must be made available; and
- deceptive advertising practices targeting minors must be prevented.
The amendments also introduce new legal definitions for “game”, “game developer”, “game distributor” and “game platform”. Gaming platforms will now be subject to additional obligations, including age-rating requirements, content removal obligations for non-compliant content, mandatory parental control tools, and local representative appointment obligations for certain foreign-based gaming platforms with significant access from Türkiye.
These new provisions will enter into force on 1 November 2026 following a six-month transition period.
Developments in Data Protection
DPA Published 2025 Activity Report
The Turkish Personal Data Protection Authority (“DPA”) has published its 2025 Activity Report, revealing a significant increase in complaints, administrative fines, and international data transfer notifications.
According to the report:
- 12,512 complaints and notifications were submitted to the DPA in 2025, representing an increase of approximately 51% compared to the previous year;
- the most common complaint categories concerned unlawful processing of personal data, unlawful data sharing, and unsolicited SMS/calls;
- administrative fines imposed on 876 data controllers exceeded TRY 352 million (Approx. EUR 6.6 million); and
- VERBIS registration obligations remained one of the leading sources of administrative sanctions.
The report further indicates that:
- 328 personal data breach notifications were submitted to the DPA;
- 2,497 standard contractual clause notifications were filed for international data transfers; and
- the use of standard contractual clauses increased significantly following the recent amendments to cross-border data transfer regime.
The report indicates that enforcement activity in Türkiye continues to intensify, particularly in relation to VERBIS compliance, personal data breach notification obligations, and international data transfer mechanisms.
Data Breach Notification
The DPA’s data breach notifications published for April 2026 (in Turkish only) may be accessed from this link.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
