Turkiye: Information and Communication Technologies Authority's regulation on social network providers including user data handling requirements

On 1 April 2023, the Information Technologies and Communication Authority (BTK)'s decision titled "Procedures and Principles about Social Network Providers," entered into force. This decision, issued under Additional Article 4 of Law No. 5651 on the Regulation of Broadcasts via the Internet and the Prevention of Crimes Committed through Such Broadcasts (Internet Law), replaces BTK’s 2 October 2020 decision that initially set out obligations for social network providers. The updated regulation strengthens data governance requirements, requiring providers with more than one million daily users from Turkey to store user data domestically and take necessary measures to safeguard user information. Platforms must ensure that personal data processing complies with Turkish data protection laws, implement security measures to prevent breaches and provide clear policies on data retention and deletion. Additionally, in cases of national security concerns or investigations, providers must cooperate with judicial and law enforcement authorities in sharing relevant user information. Failure to comply with these data localisation and security requirements may result in administrative fines, operational restrictions, or enforcement actions by BTK.