Türkiye enacts cybersecurity law with harsh penalties

ANKARA

The Turkish parliament has ratified a cybersecurity law, introducing prison sentences of up to 12 years for individuals targeting the country's digital infrastructure with cyberattacks.

As per the newly enacted law, those who store any data as a result of such attacks will also face eight to 12 years in prison. Additionally, those who spread, transfer or attempt to sell this information could face up to 15 years in prison.

If the crime is committed by a public official, a group of individuals or as part of an organized criminal network, the penalties will be further increased.

The new law aims to strengthen Türkiye’s cybersecurity framework by identifying and neutralizing threats, mitigating the impact of cyber incidents and ensuring the protection of public institutions and professional organizations with public status from cyberattacks.

Within this scope, individuals and companies obstructing legally authorized cybersecurity audits by withholding data or systems could face up to three years in prison and hefty fines. Organizations failing to comply with cybersecurity regulations, including reporting vulnerabilities, will also face fines ranging from 1 million to 10 million Turkish Liras.

Unauthorized disclosure of classified or sensitive cybersecurity information will be strictly penalized, with individuals making this material available, distributing it, or selling it — whether for a profit or for free — facing a penalty of three to five years in prison.

Moreover, individuals leaking or falsely claiming a data breach to incite public fear could face up to five years in prison, the new law determined.

It also defined the duties of the recently established Cybersecurity Directorate, which will oversee policies, regulations and strategies to enhance national cyber resilience.

According to the new law, employees of the directorate will be prohibited from working in the public and private cybersecurity sector for two years after leaving their position. They also cannot engage in related commercial activities or hold shares in cybersecurity firms during this period.