Turkiye: Cybersecurity Law (Law No. 7545) including establishment of Cybersecurity Authority was introduced to the Grand National Assembly

On 10 January 2025, the Cybersecurity Law including establishment of Cybersecurity Authority was introduced to the Grand National Assembly. The scope of this Law would include public institutions, professional organisations, private entities, and individuals operating in the cyberspace domain, with exceptions for intelligence activities under national security laws. The Law would provide definitions, basic principles and responsibilities for cybersecurity, including protecting critical infrastructure, data security and the role of cybersecurity response teams. The Law would establish a Cybersecurity Authority responsible for conducting risk assessments, overseeing cybersecurity incident response teams, and setting cybersecurity standards, certifications, and audits. The Authority would further be empowered to enforce security measures, conduct cybersecurity audits, and impose sanctions for non-compliance. The Authority's duties also include identifying and categorising critical infrastructure sectors, collecting and analysing data on cyber incidents, regulating cybersecurity service providers, and cooperating with international cybersecurity bodies. The Cybersecurity Council, composed of the president, vice president and ministers, would be responsible for formulating cybersecurity policy and determining strategic priorities.