Technology and Telecommunications Law in Türkiye: Compliance and Contracts

The legal agenda of technology companies changes quickly. When a product goes live, several sets of rules often come into play at once: processing of user data, payment and e-commerce rules, liability for content, contract terms and rights in the software itself. This page summarises the main legal framework faced by companies in the sector.

Electronic communications

Providing electronic communications services or operating infrastructure requires authorisation from the Information and Communication Technologies Authority (BTK) under Electronic Communications Law No. 5809. The scope of authorisation is determined by the type of service provided. Authorised operators are subject to BTK secondary regulations on matters such as numbering, subscriber rights, quality of service, processing of personal data and confidentiality.

Internet content and platforms

Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed through Such Publications regulates the responsibilities of content, hosting and access providers and the procedures for content removal and access blocking. Article 9 of Law No. 5651, which governed applications to the criminal judgeship of peace for content infringing personality rights, ceased to be in force from 10 October 2024 following annulment by the Constitutional Court; since then, the general route has been an action and interim injunction before the civil court of first instance under Articles 24 and 25 of the Turkish Civil Code. The procedure in Art. 9/A continues to apply to content infringing the privacy of private life. Whether new legislation has been enacted to fill the legal gap should be followed separately. Social network providers with daily access from Türkiye above a certain number have additional obligations such as appointing a representative in Türkiye, responding to applications in time and reporting.

E-commerce activities fall within Law No. 6563 on the Regulation of Electronic Commerce. The requirement to obtain the recipient's prior consent for sending commercial electronic messages, the service provider's information obligations and the rules on e-commerce intermediary service providers are found in this Law. For sales to consumers, Law No. 6502 and the rules on distance contracts also apply.

Data protection and cybersecurity

Almost all technology companies process personal data. Under Personal Data Protection Law No. 6698, there are obligations of notice, explicit consent, data security and data breach notification. Data transfers through cloud services or group companies abroad must comply with the procedures in Article 9 of the Law, as amended in 2024. Cybersecurity Law No. 7545, adopted in 2025, has also introduced new obligations for certain companies, especially public bodies and critical infrastructure operators; the scope of these obligations is being determined by secondary legislation. The legal validity of electronic signatures is governed by Electronic Signature Law No. 5070.

Software and technology contracts

Computer programs are protected as works under Law No. 5846 on Intellectual and Artistic Works. In software development agreements, who will own the economic rights in the source code must be set out in writing, with the rights listed individually. In SaaS and licence agreements, matters such as service level commitments, liability caps, data ownership, return of data on termination and source code escrow are important. User agreements are subject to unfair terms control when they are addressed to consumers.

Our firm's work in this sector

We work with technology companies on compliance assessments, user agreements and privacy texts, software and SaaS agreements, investment and acquisition transactions and content-related disputes. This work brings together our practice in Personal Data Protection, Intellectual Property, Commercial and Corporate Law and Mergers and Acquisitions.

Main topics

Electronic communications authorisations (Law No. 5809)
Internet content, access blocking and content removal (Law No. 5651)
E-commerce obligations (Law No. 6563)
Personal data and cross-border transfers
Software licence, SaaS and development agreements
Cybersecurity and electronic signatures

Frequently asked questions

Is using a cloud server abroad contrary to the KVKK?

It is not; however, the transfer of personal data abroad must rest on one of the procedures in KVKK Art. 9. The route most often used in practice is the standard contract, which must be notified to the Board within five working days of signature.

What is needed to send promotional SMS messages to customers?

Under Law No. 6563 and the Regulation on Commercial Communications and Commercial Electronic Messages, the recipient's consent must be obtained before sending commercial electronic messages, and consents must be registered in the Message Management System (İYS); there are exceptions to this rule for messages sent to merchants and tradespeople. The recipient may exercise the right to refuse at any time.

I had a firm develop software for me. Is the source code mine?

Unless the economic rights in the source code were expressly assigned in writing in the agreement, they as a rule remain with the developer. Under FSEK Art. 52, the rights assigned must be specified individually in the agreement.

Can I have a post about me removed from the internet?

An application may first be made to the content, hosting or social network provider. Following the annulment of Article 9 of Law No. 5651 by the Constitutional Court, the general route for infringements of personality rights is an action and interim injunction before the civil court of first instance (TMK Arts. 24–25); Art. 9/A of Law No. 5651 applies to infringements of the privacy of private life.

We use cookies on our website. Do we need consent from visitors?

Explicit consent is not required for cookies that are strictly necessary for the site to function. For analytics, personalisation and marketing cookies, however, the Personal Data Protection Authority's guide on cookie practices as a rule requires the visitor's explicit consent. These cookies should not run until the visitor consents; the option to refuse should be offered as easily as the option to accept, and a privacy notice should be provided separately.

Legislation and sources

The information on this page is general and does not constitute legal advice. As legislation may change, the current rules must be assessed separately for your particular situation.

Telecommunications and Technology