New Cybersecurity Framework: Amendments Adopted By Parliament Await Official Gazette Publication

On 24 July 2026, the Grand National Assembly of Türkiye (“Parliament”) adopted the “Bill Amending Certain Laws and Decree-Laws” (“Bill”). In addition to pension and tax measures, Bill introduces significant changes affecting information technologies, telecommunications and cybersecurity. Amendments focus on expanding duties and powers of Cybersecurity Presidency (“Presidency”), established by Presidential Decree No. 177 and placed on a statutory basis by Cybersecurity Law No. 7545 (“Law”), restructuring electronic communications administration and updating sectoral implementation processes.

Bill is the latest step in Türkiye’s ongoing cybersecurity transformation. This process began with Presidency’s establishment on 8 January 2025 and Law’s entry into force on 19 March 2025. On 28 March 2025, Presidential Digital Transformation Office was abolished and certain duties concerning digital government and public-sector digital transformation were transferred to Presidency. At the first Cybersecurity Board meeting on 5 May 2026, 15 areas were designated as critical infrastructure sectors. Bill therefore continues the centralization of cybersecurity and digital governance powers within Presidency.

1. One of the most notable amendments is the transfer to Presidency of authority to determine strategies, formulate policies and regulate internet domain names. This area, previously handled by Information and Communication Technologies Authority (“ICTA”), will now fall directly within Presidency’s regulatory remit.
2. In urgent cases where delay may be detrimental, Presidency will also be authorized to order measures upon a request from security or intelligence agencies or on its own initiative. Telecommunications operators, access providers, data centers, content providers and hosting providers must implement notified decisions within two hours. Decisions must be submitted to a criminal judgeship of peace for approval within 24 hours and will automatically lapse if no decision is issued within 48 hours.
3. Bill also provides for administrative sanctions against persons and entities failing to fulfil their obligations. Presidency may impose an administrative fine of TRY 20,000 to TRY 100,000 per violation. Unpaid fines will be collected by tax offices and transferred to Presidency’s accounts.
4. Another significant amendment concerns consolidation of cybersecurity powers under a single authority. Amendments to Law on Police Duties and Powers, Law No. 5651, Electronic Communications Law and Law consolidate various regulatory powers relating to internet domain name management and detection and analysis of communications within Presidency.
5. Bill also regulates the transition between ICTA and Presidency. ICTA’s movable assets, IT infrastructure, systems, data centers and related documents concerning transferred duties and powers will be transferred to Presidency within three months of entry into force. Existing ICTA regulations will remain applicable until Presidency issues its secondary legislation, while existing legislative references to ICTA will be deemed to refer to Presidency.

Amendments adopted by Parliament substantially reshape cybersecurity and electronic communications administration. Expansion of Presidency’s powers and transfer of certain ICTA duties and infrastructure are expected to begin a new implementation period. Presidency is expected to issue secondary legislation and an internet domain name strategy, sector stakeholders to complete compliance processes, and competent authorities to clarify respective powers of ICTA and Presidency.

The adopted Bill is available here. (Only available in Turkish)