TÜRKIYE Law and Practice Contributed by: Bora Yazıcıoğlu, Alper Işık, Emre Öntekin and Ferat Gümüş, YAZICIOGLU Legal
The Guideline for Establishment and Management of Institutional CERTs (“Institutional CERT Guideline”) and the Guideline for Establishment and Management of Sectoral CERTs (“Sectoral CERT Guideline”) These guidelines, published by the National Cyber Incidents Response Centre (TR-CERT), provide guid - ance on establishing and managing institutional CERTs and sectoral CERTs in relevant organisations and their relationship with each other and the TR-CERT. They also include the principles for communication with internal/external stakeholders and establishing insti - tutional and sectoral CERTs. Decree No 2019/12 on Information and Communication Security Measures issued by the Presidency of Türkiye (“Presidency Decree”) The Presidency Decree sets security measures for critical data, the compromise of which could threaten national security or public order. It mandates securely storing critical data (eg, population, health and com - munication records, genetic and biometric data) within Türkiye. The Presidency Decree applies to public institutions and organisations and businesses providing critical infrastructure services (eg, electronic communica - tions, banking and finance, and transportation); see 2.1 Scope of Critical Infrastructure Cybersecurity Regulation for further details. The Turkish Data Protection Law No 6698 (“DP Law”) and its secondary legislation The DP Law covers personal data processing activi - ties in Türkiye. From a cybersecurity perspective, it also regulates the security of personal data and data processing systems. According to the DP Law, con - trollers are obliged to take all necessary technical and organisational measures to provide a sufficient level of security to: • prevent unlawful processing and accessing of per - sonal data; and • ensure the safekeeping of personal data. These obligations, along with incident notification obli - gations, overlap with the Cybersecurity Act. However, the interplay between the DP Law and the Cyberse -
internet. Although the Internet Law imposes cyberse - curity-related duties on the Turkish Information and Communication Technologies Authority (ICTA), that body will no longer be able to carry out these duties when the Directorate’s organisation is completed according to the Cybersecurity Act. The Law on Electronic Communication No 5809 (“E-Communication Law”) Information security is among the basic principles in the E-Communication Law, which provides the main framework for network security, the confidentiality of communication and personal data protection. ICTA is the authorised regulatory body in the e-com - munications sector, but its authority in cybersecurity measures has now been transferred to the Directorate. The Council of Ministers Decision on Carrying Out, Managing and Co-ordinating National Cybersecurity Activities, dated 11 June 2012 (“Council of Ministers Decision on Cybersecurity”) This decision is one of the landmarks of Türkiye’s cybersecurity legislation, defining national cyberse - curity and setting cybersecurity-related duties and powers for the MTI. The Cybersecurity Act transfers the MTI’s cybersecurity-related duties and powers to the Directorate; however, it does not explicitly annul this decision. Presidential Decree No 177 on the Cybersecurity Directorate On 8 January 2025, Presidential Decree No 177 on the Cybersecurity Directorate established the Direc - torate as a public legal entity affiliated with the Presi - dency, with financial autonomy. The decree grants the Directorate general regulatory power on cybersecurity matters; please see 1.3 Cybersecurity Regulators for further discussion of the duties of the Directorate. The Communiqué on Procedures and Principles of the Establishment, Duties and Activities of Cyber- Incidents Response Teams (CERTs) (“Communiqué on CERTs”) The purpose of this communiqué is to ensure CERTs carry out their services effectively and efficiently by determining the procedures and principles of their establishment, duties and work.
418 CHAMBERS.COM
Powered by FlippingBook