Cybersecurity Directorate takes over key digital governance powers in Türkiye

Law No. 7590 on Amendments to Certain Laws and Decree Laws (“Law”) entered into force upon its publication in the Official Gazette on 31 July 2026, introducing a significant institutional restructuring of Türkiye’s digital regulatory landscape by transferring several internet governance powers previously exercised by the Information and Communication Technologies Authority (“ICTA”) to the Cybersecurity Directorate.

The Law amends Law No. 5651 on the Regulation of Publications Made on the Internet and the Combating of Offences Committed Through Such Publications (“Internet Law”), the Electronic Communications Law No. 5809 (“ECL”), and the Cybersecurity Law No. 7545 (“Cybersecurity Law”). Its main purpose is to complete the institutional restructuring that began with the establishment of the Cybersecurity Directorate by transferring a number of internet governance and cybersecurity-related duties and powers from the ICTA to the Cybersecurity Directorate.

In practical terms, the Cybersecurity Directorate will now serve as a key digital governance authority with responsibility not only for cybersecurity matters, but also for internet domain names, selected internet governance functions, and the coordination of access-blocking and content-removal measures under the Internet Law.

The electronic communications authorisation regime remains largely unchanged, and the ICTA continues to retain its core regulatory and licensing functions for electronic communications operators. The Law also includes transitional provisions to preserve regulatory continuity until the Cybersecurity Directorate adopts the secondary legislation required to implement its new powers.

1. Amendments to the Internet Law

The Law amends the Internet Law to reflect the transfer of internet-related regulatory and supervisory powers from the ICTA to the Cybersecurity Directorate. The definition of the ICTA Chairman is replaced with a definition of the Cybersecurity Chairman, and the Cybersecurity Directorate is introduced as the “Directorate” under the Internet Law.

As a result, references to ICTA and the ICTA Chairman are replaced, where relevant, with references to the Cybersecurity Directorate and the Cybersecurity Chairman. Beyond these definitional changes, the Law transfers several important supervisory and regulatory functions previously exercised by the ICTA to the Cybersecurity Directorate.

Competent authority and secondary legislation

The Law transfers the ICTA’s regulatory functions under the Internet Law to the Cybersecurity Directorate. Article 10, which regulates the institutional structure and duties of the competent authority under the Internet Law, is amended to reflect the Cybersecurity Directorate’s new responsibilities.

Article 11, which authorises secondary legislation governing the obligations of hosting providers, access providers and commercial collective use providers, is also amended. As a result, the Cybersecurity Directorate will be responsible for adopting the relevant implementing legislation.

Supervision of access providers

The Cybersecurity Directorate becomes the competent authority for the notification obligations applicable to access providers, the supervision of the Access Providers Association, and the oversight of commercial collective use providers under the Internet Law.

Content removal and access blocking powers

Articles 8 and 9/A of the Internet Law are amended to designate the Cybersecurity Directorate as the administrative authority responsible for receiving, implementing, and coordinating content-removal and access-blocking decisions. This makes the Cybersecurity Directorate the principal administrative authority for these measures under the Internet Law.

Social network providers and gaming platforms

The amendments also affect Additional Article 4 of the Internet Law, which regulates social network providers and gaming platforms. The Cybersecurity Directorate assumes the supervisory and enforcement powers previously regulated to be exercised by the ICTA in this area.

In particular, the Cybersecurity Directorate will be responsible for supervising compliance with representative appointment obligations, determining the procedures and principles for those obligations and the age-based rating system, imposing administrative fines and advertisement bans, applying to the criminal peace court for bandwidth restriction orders, receiving transparency reports, overseeing content-removal reporting obligations, requesting information and documentation, and monitoring compliance with transparency and accountability obligations.

2. Amendments to the ECL

The ECL amendments clarify the division of responsibilities between the ICTA and the Cybersecurity Directorate. The Law introduces the Cybersecurity Directorate as the “Directorate” under Article 3 of the ECL. Accordingly, references to the “Directorate” now refer to the Cybersecurity Directorate, while references to the “Authority” continue to refer to the ICTA.

Powers of the Cybersecurity Directorate

Under the new Article 60/A of the ECL, the Cybersecurity Directorate may determine strategies and policies relating to internet domain names and issue the relevant secondary legislation.

The Cybersecurity Directorate may also determine and implement urgent measures, on its own initiative or upon the request of security and intelligence authorities, where one or more of the grounds listed in Article 22 of the Constitution are present, including national security, public order, and the protection of others’ rights and freedoms. Decisions adopted under this provision are immediately notified to operators, access providers, data centres, and content and hosting providers, which must implement the relevant measures within two hours of notification.

The Cybersecurity Directorate may also impose administrative fines ranging from TRY 20,000 (approx. EUR 350) to TRY 100,000 (approx. EUR 1,800) for each violation where obligations relating to its ECL duties and powers are not fulfilled. In parallel, Article 60(10) of the ECL, which previously vested these powers in the ICTA, is repealed.

Internet domain name responsibilities

The introduction of Article 60/A is supported by further ECL amendments transferring responsibility for internet domain names from the Ministry of Transport and Infrastructure (“Ministry”) and the ICTA to the Cybersecurity Directorate. Article 5, which sets out the Ministry’s duties and powers, is amended to remove internet domain names from the list of scarce resources for which the Ministry determines strategies and policies.

Similarly, Article 6(1)(v), which previously required the ICTA to carry out duties assigned by the President and the Ministry in relation to internet domain names, is repealed in full, removing the ICTA’s statutory responsibilities in this area.

The transfer is completed through the amendment to Article 35 of the ECL, which governs the allocation and management of internet domain names. References to the Ministry are replaced with references to the Cybersecurity Directorate. Taken together, these amendments centralise internet domain name strategy, policy and regulation under the Cybersecurity Directorate.

Lawful interception infrastructure

The Law also transfers responsibility for the technical infrastructure supporting lawful interception. Article 12(2)(g) of the ECL, which previously authorised the ICTA to require operators to establish the technical capability necessary to enable lawful interception by competent public authorities, is repealed.

This amendment should be read together with the corresponding amendments to the Cybersecurity Law and the Law on Police Duties and Powers No. 2559 introduced by the same Law. Collectively, these amendments transfer responsibility for providing the technical infrastructure necessary for lawful interception to the Cybersecurity Directorate. Accordingly, the technical implementation of criminal procedure measures relating to the detection, interception and recording of communications will now be coordinated through a single centre operating within the Cybersecurity Directorate.

3. Other significant amendments and continuity of the existing regulatory framework

The Law also amends the Cybersecurity Law by strengthening the existing administrative sanctions regime. Failure to provide the Cybersecurity Directorate with requested data, information, documents, hardware, software or other assistance in connection with its statutory duties will now be subject to significantly increased administrative fines.

The Law includes transitional provisions to ensure continuity following the transfer of powers to the Cybersecurity Directorate. Existing secondary legislation governing the transferred duties and powers will remain in force until the Cybersecurity Directorate adopts its own implementing legislation.

During this interim period, references in existing secondary legislation to the ICTA and the former Telecommunications Communication Directorate will be deemed to refer to the Cybersecurity Directorate. References to the ICTA Chairman, the ICTA Board and the Head of the Telecommunications Communication Directorate will be deemed to refer to the Cybersecurity Chairman.

The amendments primarily restructure Türkiye’s digital regulatory framework by consolidating internet governance and cybersecurity-related powers under the Cybersecurity Directorate. Businesses operating in the electronic communications, internet infrastructure, hosting, access provision, social network, gaming platform, and broader digital services sectors should monitor the Cybersecurity Directorate’s forthcoming secondary legislation and assess whether their compliance frameworks, internal escalation processes, and regulatory contact points should remain fit for purpose under the new institutional structure.