Law No. 7545 on Cyber Security (7545 sayılı Siber Güvenlik Kanunu)

Overview

Law No. 7545 on Cyber Security was published in the Official Gazette no. 32846 on 19 March 2025. It establishes the Cyber Security Presidency (Siber Güvenlik Başkanlığı) and defines duties for everyone operating in cyberspace, with extra rules for public bodies and critical infrastructure. This record is based on the text consolidated with the 2026 amendments made by Law No. 7590. The scope covers public bodies, professional organisations and natural and legal persons operating or providing services in cyberspace (Article 2).

A definition of interest for data centres is Article 3, which defines hosting as keeping information systems in an external data centre. Protecting critical infrastructure and information systems and building a secure cyberspace is among the core principles. The obligations are in Article 7. Those providing services via information systems must report detected vulnerabilities or cyber incidents to the Presidency without delay. For public bodies and critical infrastructure, cyber-security products, systems and services must be procured from experts, manufacturers or companies authorised by the Presidency.

The Presidency may audit activities within scope, including on-site inspections (Article 8). Because details are left to regulations, the information in this record reflects only the framework of the law. Related instruments include the BTK Network and Information Security Regulation, Law No. 6698 and ISO/IEC 27001. Because the application details depend on rules the Presidency will issue, it is useful to track the current state of those rules in design and operating documents and to carry out a scope analysis at project start.

Key points

1. Published in the Official Gazette no. 32846 on 19.03.2025; the text is consolidated with the 2026 amendments by Law No. 7590.
2. Scope: public bodies, professional organisations, natural and legal persons operating or providing services in cyberspace (Article 2).
3. Hosting is defined as keeping information systems in an external data centre (Article 3).
4. Protecting critical infrastructure and information systems and building a secure cyberspace is a core principle (Article 4).
5. Service providers must report detected vulnerabilities or cyber incidents to the Presidency without delay (Article 7).
6. Cyber-security products, systems and services for public bodies and critical infrastructure must come from Presidency-authorised parties (Article 7).
7. The Presidency may audit, including on-site inspections (Article 8).
8. Related instruments: BTK Network and Information Security Regulation, Law No. 6698, ISO/IEC 27001.

Using it in design

• When the client is public-sector or critical infrastructure, flag that security systems (access control, CCTV, network security appliances) must come from authorised suppliers.
• Add an incident-reporting interface to the DCIM/operations handover.
• For projects offering external data centre services, verify the law's scope in light of the hosting definition.
• Set up an operating structure that keeps security-system records and incident logs in order for audit readiness.
• Follow the regulations and Presidency announcements for detailed obligations.

Who should read it

Data center operators in Turkey, public-sector and critical-infrastructure clients, and designers responsible for information security and compliance.

Related standards

• BTK Şebeke ve Bilgi Güvenliği Yönetmeliği
• 6698 sayılı Kanun
• ISO/IEC 27001

Publication details

Authors

Türkiye Büyük Millet Meclisi

Publisher

Türkiye Büyük Millet Meclisi

Year

2025

Document number

Kanun No. 7545 (RG 32846, 19.03.2025)

Document language

Turkish

Source type

Turkish regulation

Access

Free to read

Licence

Bibliographic reference only — the document is not redistributed here; confirm reuse terms at the original source

Citation