03 APR 2026 · Law / Act

Content moderation authority governance in Bill on Amendments to the Social Services Law and Certain Other Laws

On 4 March 2026, the Bill on Amendments to the Social Services Law and Certain Other Laws was introduced to the Grand National Assembly of Turkey. Article 22 would grant the Information Technologies and Communication Authority additional powers over social network providers. These powers include ordering content removal and access blocking, requiring risk assessments, and requesting information on algorithms, data processing mechanisms, and corporate structures. The Authority would also be ab...

Secondary evidenceContent ModerationIssuing institution: Issuing authority not identified

24 MAR 2026 · Executive Order

Decision on preparation of explicit consent and disclosure texts (No. 2026/347)

On 24 March 2026, Decision No. 2026/347 of the Turkish Personal Data Protection Board on the separate preparation of explicit consent and disclosure texts enters into force upon its publication in the Official Gazette No. 33203. The Decision requires data controllers to fulfil disclosure obligations prior to any data processing activity, independently of whether processing is based on consent or another legal ground. Where processing is based on explicit consent, the Decision requires disclos...

Primary legal sourceNational StrategyOfficial source · resmigazete.gov.tr ↗

12 MAR 2026 · Working Paper

Personal Data Protection Authority publishes report on agentic AI

Primary source (kvkk.gov.tr) dated 12 March 2026 in TR. See linked source for full text.

Secondary evidenceAgentic Ai ·Data Privacy & ProtectionIssuing institution: Issuing authority not identified

04 MAR 2026 · Law / Act

Restrictions on minors' access to social media in Bill on Amendments to the Social Services Law and Certain Other Laws

On 4 March 2026, the Bill on Amendments to the Social Services Law and Certain Other Laws, including restrictions on minors’ access to social media, was introduced to the Grand National Assembly of Turkey. Social network providers would be prohibited from providing services to children under the age of 15 and would be required to implement age verification measures to enforce this prohibition. Children aged fifteen and above would be entitled to a separate, differentiated service with protect...

Secondary evidenceContent ModerationIssuing institution: Issuing authority not identified

02 MAR 2026 · Other

Türkiye and Saudi Arabia deepen strategic cooperation with new deals

Cumhurbaşkanı Recep Tayyip Erdoğan’ın Suudi Arabistan temaslarının ardından Türkiye ile Suudi Arabistan arasında ortak bildiri yayımlandı.

Secondary evidenceTrade & Investment ·Defense & SecurityIssuing institution: Issuing authority not identified

20 FEB 2026 · Other

Personal Data Protection Authority investigation into social media platforms over processing of children's personal data

On 20 February 2026, the Personal Data Protection Authority opened investigations on its own initiative into TikTok, Instagram, Facebook, YouTube, X, and Discord in relation to the processing of children’s personal data on social media platforms. The Authority will review how these platforms process children’s personal data and examine the measures in place to protect such data.

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

11 FEB 2026 · Other

Turkish Personal Data Protection Authority source on Google Assistant data-protection oversight

Official source record dated 11 February 2026 for Turkey concerning KVKK investigates Google regarding alleged unauthorised personal data processing by Google Assistant. See the linked kvkk.gov.tr source for the authoritative text, procedural context, and implementation details.

Secondary evidenceData Privacy & Protection ·Generative AIIssuing institution: Issuing authority not identified

11 FEB 2026 · Law / Act

Turkish Personal Data Protection Authority source on Grok-related data-protection oversight

Official source record dated 11 February 2026 for Turkey concerning KVKK investigates X over suspected violations of Law on Protection of Personal Data concerning the Grok AI Assistant. See the linked kvkk.gov.tr source for the authoritative text, procedural context, and implementation details.

Secondary evidenceData Privacy & Protection ·Online Safety & Child Protection ·Generative AIIssuing institution: Issuing authority not identified

14 JAN 2026 · Other

Public announcement on push notifications sent via mobile applications

On 14 January 2026, Personal Data Protection Authority (KVKK) published a public announcement on push notifications sent via mobile applications, following complaints submitted to KVKK. The announcement concerns the of push notifications with data protection obligations, including in the context of the framework of Law No. 6698 on the Protection of Personal Data. The KVKK identified practices where explicit consent for push notifications was obtained as a single consent covering multiple purp...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

12 JAN 2026 · Policy / Guidance

Turkiye Personal Data Protection Authority releases guidance for parents of children using AI tools

Primary source (kvkk.gov.tr) dated 12 January 2026 in TR. See linked source for full text.

Secondary evidenceData Privacy & Protection ·Online Safety & Child Protection ·DeepfakesIssuing institution: Issuing authority not identified

11 JAN 2026 · Standard / Framework

Türkiye issues ethics framework to regulate AI use in schools

The Ministry of National Education has issued a comprehensive set of ethical guidelines to regulate the use of artificial intelligence in schools, introducing mandatory online ethical declarations and a centralized reporting system aimed at ensuring transparency, accountability and student safety.

Secondary evidenceOnline Safety & Child Protection ·Data Privacy & ProtectionIssuing institution: Issuing authority not identified

01 JAN 2026 · Working Paper

Turkey Draft AI Bills 2/2234 and 2/3358 — Risk-Based AI Regulation

Turkey pending horizontal AI legislation introducing risk-based classifications, high-risk AI system requirements, and alignment with EU AI Act framework.

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

01 JAN 2026 · Executive Order

Data Protection Authority updates administrative fine levels under Personal Data Protection Law

On 1 January 2026, the Personal Data Protection Authority updated the administrative fine thresholds under Law No. 6698 on the Protection of Personal Data (DPL). In accordance with Article 17(7) of the Misdemeanors Law No. 5326 and repeated Article 298 of the Tax Procedure Law No. 213, administrative fines are adjusted annually based on the revaluation rate determined and announced by the Ministry of Treasury and Finance. For the 2026 calendar year, the applicable fines were increased by 25.4...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

25 DEC 2025 · Executive Order

Presidential Decree No. 191 amending Decrees to establish artificial intelligence infrastructure and policy functions

On 25 December 2025, the Presidential Decree No. 191 on Amending Certain Presidential Decrees entered into force upon its publication in the Official Gazette No. 33118. The Decree amends Presidential Decree No. 1 on the Presidential Organisation by renaming the General Directorate of National Technology under the Ministry of Industry and Technology as the General Directorate of National Technology and Artificial Intelligence. It assigns responsibilities for developing a national data centre a...

Primary legal sourceNational StrategyOfficial source · resmigazete.gov.tr ↗

25 DEC 2025 · Other

Data Protection Authority investigation into Uludag Elektrik Dagitim AS data breach

On 25 December 2025, the Data Protection Authority (KVKK) issued a public disclosure notice regarding a data breach involving electricity network Uludağ Elektrik Dağıtım AŞ. KVKK stated that the investigation of the breach was ongoing, though it summarised the relevant facts of the breach, which occurred on 5 August 2025 and was detected on 18 August 2025, affecting a dataset about subscribers involving 57 data categories.

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

25 DEC 2025 · Executive Order

Presidential Decree amending Decree on the Cyber Security Directorate to establish public artificial intelligence functions

On 25 December 2025, Presidential Decree No. 192 on Amending the Presidential Decree on the Cyber Security Directorate entered into force upon its publication in the Official Gazette No. 33118. The Decree amends Presidential Decree No. 177 on the Cyber Security Directorate by expanding its mandate to include public-sector artificial intelligence and digital government functions. It establishes the General Directorate of Public Artificial Intelligence within the Cyber Security Directorate and ...

Primary legal sourceNational StrategyOfficial source · resmigazete.gov.tr ↗

25 DEC 2025 · Policy / Guidance

Türkiye broadens tech governance with new AI directorates

Primary source (resmigazete.gov.tr) dated 25 December 2025 in TR. See linked source for full text.

Official materialData Privacy & Protection ·CybersecurityOfficial source · resmigazete.gov.tr ↗

11 DEC 2025 · Executive Order

Data protection regulation in Regulation on Promotion and Information Activities in Health Services

On 12 November 2025, the Ministry of Health published the Regulation on Promotion and Information Activities in Health Services in the Official Gazette, with the Regulation taking effect on the same date. The Regulation applies to all instances in which personal data or personal health data are recorded, processed, or shared for promotional or informational purposes. The Regulation requires compliance with the Personal Data Protection Law No. 6698, the Patient Rights Regulation, and the Regul...

Primary legal sourceNational StrategyOfficial source · resmigazete.gov.tr ↗

06 DEC 2025 · Other

Competition Authority investigation into Google over alleged abuse of dominance in online advertising

On 12 June 2025, the Turkish Competition Authority opened an investigation into Google over abuse of dominance in online advertising. The investigation focuses on whether Google abused its dominance in search-based advertising by using its Performance Max (PMAX) campaign to favour its broader advertisement ecosystem. The investigation will also examine whether Google engaged in exploitative practices due to PMAX’s lack of transparency and control, and distorted competition by combining data f...

Secondary evidenceCompetitionIssuing institution: Issuing authority not identified

25 NOV 2025 · Other

South Korea and Turkey agree to boost cooperation, covering AI

At the invitation of His Excellency Mr. Recep Tayyip Erdoğan, President of the Republic of Türkiye, His Excellency Mr. Lee Jae Myung, President of the Republic of Korea, paid a State Visit to Türkiye on 24-25 November 2025.

Secondary evidenceGenerative AIIssuing institution: Issuing authority not identified

24 NOV 2025 · Other

Generative Artificial Intelligence and Personal Data Protection Guide (in 15 Questions)

Official source record dated 2025-11-24 for Turkey concerning Generative Artificial Intelligence and Personal Data Protection Guide (in 15 Questions). See the linked kvkk.gov.tr source for the authoritative text, procedural context, and implementation details.

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

24 NOV 2025 · Policy / Guidance

Turkish Personal Data Protection Authority source on generative AI governance

Official source record dated 24 November 2025 for Turkey concerning KVNKK releases generative AI and personal data protection guide. See the linked kvkk.gov.tr source for the authoritative text, procedural context, and implementation details.

Secondary evidenceData Privacy & Protection ·Generative AI ·Online Safety & Child ProtectionIssuing institution: Issuing authority not identified

07 NOV 2025 · Law / Act

Cybersecurity regulation in Bill establishing an AI legal framework through modifications to existing laws (Bill no. 2/3358)

On 7 November 2025, the Bill establishing an AI legal framework in Türkiye was introduced to the Grand National Assembly. The proposed legislation clarifies responsibilities for both users and developers of AI. The Bill requires that AI data sets be anonymous and non-discriminatory, treating biased data as a security violation (modifying Law No. 6698). It also imposes obligations on service providers to use transparent data and conduct regular cybersecurity tests (modifying Law No. 7545) for ...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

04 NOV 2025 · Other

Personal Data Protection Authority guide on protection of personal data in the payment and electronic money sector

On 11 April 2025, the Personal Data Protection Authority published a guide on data protection in the payment and electronic money sector. The guide provides practical guidance for data controllers, including electronic money institutions, point of sale service providers, mobile payment service providers, bill payment intermediaries, and money transfer intermediaries. The guidance addresses areas such as the roles of data controllers and processors, legal bases for data processing, and rules f...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

22 OCT 2025 · Law / Act

Bill amending Penal Code clarifying scope of crime of obscenity

On 22 October 2025, the Bill amending the Penal Code, clarifying the scope of the crime of obscenity, was introduced to the Grand National Assembly. The Bill amends Article 226 of the Turkish Penal Code to define the scope of obscenity and regulate the protection of children from pornographic content. It makes it an offence to provide, show, read, or otherwise make pornographic materials accessible to children, and to offer such materials for sale, rent, or distribution, including through adv...

Secondary evidenceContent ModerationIssuing institution: Issuing authority not identified

29 SEP 2025 · Other

Azerbaijan and Türkiye aim to unite forces in AI

Azerbaijan and Türkiye plan to join forces in the field of artificial intelligence (AI) with the goal of ranking among the world's top 20 countries, Zafer Kucuksabanoglu, Chairman of Türkiye's Artificial Intelligence Policy Association (AIPA), told journalists, Report informs.

Secondary evidenceData Privacy & Protection ·Defense & National Security ·CybersecurityIssuing institution: Issuing authority not identified

04 SEP 2025 · Executive Order

Amendment to data protection authority (VERBIS) registration exemption under Personal Data Protection Board Decision No. 2025/1572

On 4 September 2025, the Personal Data Protection Board adopted Decision No. 2025/1572 amending Decision No. 2018/87 on exemption from the obligation to register with the Data Controllers Registry Information System (VERBİS). The Decision updated the wording of the exemption criteria concerning data controllers’ annual number of employees, total annual financial balance, and main activity involving the processing of special categories of personal data. The amendment was adopted pursuant to Ar...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

28 AUG 2025 · Law / Act

Competition Board investigation into Spotify over alleged violation of Act on Protection of Competition

On 28 August 2025, the Competition Board opened a full investigation into Spotify over violations of Law No. 4054 on Protection of Competition in the online music streaming market. The Board will examine whether Spotify discriminates among rights holders in playlist placement, ranking, visibility, or recommendation algorithms, and whether it hinders rights holders earning royalties through predatory subscription pricing. The investigation, launched under Article 41 of the Law, does not imply ...

Secondary evidenceCompetitionIssuing institution: Issuing authority not identified

14 AUG 2025 · Other

Personal Data Protection Authority investigation into Biletal over data breach

On 14 August 2025, the Personal Data Protection Authority (KVKK) announced the launch of an investigation into a personal data breach reported by Biletal Domestic and Foreign Trade. The breach was detected on 11 August 2025 by the company’s IT teams in coordination with the Information and Communication Technologies Authority, after cyber attackers offered customer identity, contact, and transaction data for sale on illegal online platforms. The incident is estimated to have affected around 7...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

11 JUL 2025 · Law / Act

Turkey introduces bill to establish content moderation obligations within an AI legal framework

Primary source (cdn.tbmm.gov.tr) dated 7 November 2025 in TR. See linked source for full text.

Secondary evidenceDeepfakes ·Cybersecurity ·Data Privacy & ProtectionIssuing institution: Issuing authority not identified

10 JUL 2025 · Other

Data Protection Authority's guide to the Data Controllers Registry Information System (VERBIS)

On 7 October 2025, the Personal Data Protection Authority (KVKK) released guide to the Data Controllers Registry Information System (VERBIS). The guide complements the VERBIS system by presenting the framework of obligations in a question-and-answer format. It provides clarifications on the purpose and scope of the system, the obligations of data controllers, and the statutory basis under Article 16 of the Law on the Protection of Personal Data No. 6698. It addresses the registration requirem...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

08 MAY 2025 · Law / Act

Law on Regulation of Publications on the Internet and Combating Crimes Committed Through Such Publications (No. 2/3102)

On 8 May 2025, a legislative proposal to repeal Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed Through Such Publications was submitted to the Grand National Assembly of Türkiye by Member of Parliament Mustafa Bilici. The proposal argues that Law No. 5651, which entered into force on 4 May 2007, has enabled administrative interventions such as content removal, access blocking, and bandwidth throttling without judicial authorisation. It states that...

Secondary evidenceContent ModerationIssuing institution: Issuing authority not identified

02 MAY 2025 · Standard / Framework

Data Protection Authority guidelines on standard contracts concerning cross-border data transfers

On 5 February 2025, the Turkish Data Protection Authority (KVKK) published guidelines on standard contracts for the international transfer of personal data. The initiative concerns the validity of standard contracts used in the transfer of personal data abroad, as regulated by Article 9 of the Personal Data Protection Law No. 6698. The standard contracts must be signed by authorised representatives of both parties and, if they are in a foreign language, the signatures must also appear on the ...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

19 MAR 2025 · Law / Act

Establishment of the Cybersecurity Authority in Cybersecurity Law (Law No. 7545)

On 19 March 2025, the Cybersecurity Law (Law No. 7545) including establishment of Cybersecurity Authority entered into force. The scope of this Law includes public institutions, professional organisations, private entities, and individuals operating in the cyberspace domain, with exceptions for intelligence activities under national security laws. The Law provides definitions, basic principles and responsibilities for cybersecurity, including the protection of critical infrastructure, data se...

Primary legal sourceNational StrategyOfficial source · resmigazete.gov.tr ↗

19 MAR 2025 · Law / Act

Import tariff exception in Cybersecurity Law (Law No. 7545)

On 19 March 2025, the Cybersecurity Law (Law No. 7545) entered into force. The scope of this Law encompasses public institutions, professional organisations, private entities, and individuals operating within the cyberspace domain, with exceptions for intelligence activities under national security laws. The Law provides definitions, basic principles and responsibilities for cybersecurity, including the protection of critical infrastructure, data security and the role of cybersecurity respons...

Primary legal sourceNational StrategyOfficial source · resmigazete.gov.tr ↗

19 MAR 2025 · Law / Act

Security obligations in Cybersecurity Law (Law No. 7545)

On 19 March 2025, the Cybersecurity Law (Law No. 7545) entered into force. The Law’s obligations apply to public institutions, professional organisations, private entities and individuals operating in cyberspace, with exceptions for intelligence activities in accordance with national security laws. The Law defines the basic principles, responsibilities and measures for cybersecurity, including the protection of critical infrastructure, data security and the role of cybersecurity response team...

Primary legal sourceNational StrategyOfficial source · resmigazete.gov.tr ↗

19 MAR 2025 · Law / Act

Approval requirement for mergers of cybersecurity firms in Cybersecurity Law (Law No. 7545)

Primary legal sourceCompetitionOfficial source · resmigazete.gov.tr ↗

03 MAR 2025 · Other

Personal Data Protection Authority guide on processing of special personal data

On 26 February 2025, the Personal Data Protection Authority of Turkey adopted the guide on processing special categories of personal data. The guide clarifies legal requirements and compliance following amendments to the Law on Protection of Personal Data. The guide outlines conditions for processing special categories of personal data, reinforcing the principles of legality, accuracy, purpose limitation, proportionality, and retention limits. It clarifies that processing is generally prohibi...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

03 MAR 2025 · Working Paper

Information Technologies and Communication Authority inquiry into sixth generation (6G) mobile communication technologies

On 3 March 2025, the Information and Communication Technologies Authority of Turkey published a report on Sixth Generation (6G) Mobile Communication Technologies. The report outlines global trends and ongoing research in 6G, emphasising the driving forces, needs, and goals behind its development. It highlights the contributions expected from 6G technologies, use cases, and technological innovations, particularly the roles of AI, machine learning, and advanced antenna systems. It underscores T...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

21 JAN 2025 · Executive Order

Information Technologies and Communication Authority regulation on ensuring national cyber security and increasing cyber deterrence

On 21 January 2025, the Information Technologies and Communication Authority (BTK) closes its public consultation on the draft regulation titled Ensuring National Cybersecurity and Enhancing Cyber Deterrence. The draft outlines a framework for safeguarding critical infrastructure, mitigating cyber threats, and enhancing national cyber resilience. The draft regulation's provisions include the roles and responsibilities of the National Cyber Incident Response Center (USOM), Sectoral and Institu...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified