As discussed in our publication dated 30 July 2026, the Law No. 7590 on Amendments to Certain Laws and Decree Laws (the “Law”), which aims to expand the powers of the Cybersecurity Presidency, entered into force upon its publication in the Official Gazette dated 31 July 2026. The Law introduces comprehensive amendments to legislation governing, among others, cybersecurity, taxation, electronic communications, public procurement, social security, and transportation.
A significant portion of these amendments consists of provisions that substantially expand the powers of the Cybersecurity Presidency (“Presidency”).
Expansion of the Powers of the Cybersecurity Presidency
The Law introduces a new Article 60/A titled “Authority of the Presidency and Administrative Sanctions” to the Electronic Communications Law No. 5809. Under this provision, the Presidency is vested with the authority to determine strategies and policies concerning internet domain names and to adopt regulations in this area.
In addition, where one or more of the grounds set out under Article 22 of the Constitution regarding the freedom of communication exist and there is urgency due to the risk of delay, the Presidency may, upon the request of security and intelligence authorities or on its own initiative, determine the necessary measures and immediately notify operators, access providers, data centers, and the relevant content and hosting providers of its decisions. Such decisions must be implemented within two hours of notification. Furthermore, the decisions must be submitted to a criminal judgeship of peace for approval within 24 hours, and the judge must issue a decision within 48 hours; otherwise, the measure will automatically cease to have effect.
The new provision also authorizes the Presidency to impose administrative fines ranging from TRY 20,000 to TRY 100,000 for each violation committed by persons who fail to fulfil their obligations relating to the duties and powers of the Presidency under the Electronic Communications Law. Administrative sanction decisions issued by the Presidency may be challenged before the administrative courts, and such proceedings will be treated as priority cases.
Amendments Introduced for Compliance with the Cybersecurity Law
The Law also introduces extensive harmonization amendments to complete the institutional framework envisaged under the Cybersecurity Law No. 7545.
Accordingly:
- References to the Information and Communication Technologies Authority (“ICTA”), the Information and Communication Technologies Board, and similar authorities contained in various laws, particularly the Law No. 5651 on the Regulation of Publications on the Internet, have been replaced with references to the Cybersecurity Presidency and the President of Cybersecurity. In addition, various duties and powers previously vested in the ICTA have been transferred to the Presidency.
- The duties of the ICTA relating to internet domain names under the Electronic Communications Law have been abolished and transferred to the Presidency.
- A provisional article added to the Cybersecurity Law introduces detailed transitional provisions governing the transfer of personnel, movable and immovable assets, IT infrastructure, data centers, contracts, rights and obligations, as well as pending litigation and enforcement proceedings, in connection with the transfer of duties and powers from the ICTA to the Presidency.
- In addition, references to the ICTA contained in various pieces of legislation, including the Police Duties and Powers Law No. 2559, the Law No. 5651, the Electronic Communications Law No. 5809, the Cybersecurity Law No. 7545, and the Law No. 7578, have been updated to reflect the new institutional structure centered on the Presidency.
Other Significant Amendments
In addition to the cybersecurity-related changes, the Law also:
- Amends the Special Consumption Tax (“SCT”) regime applicable to motor vehicles by introducing a minimum fixed SCT for certain vehicles and authorizing the President of the Republic to determine different tax rates based on criteria such as engine power, drivetrain, battery capacity, and emission type;
- Increases the minimum retirement pension to TRY 23,552;
- Introduces social security premium support for accommodation facilities holding tourism operation certificates for the period between May and December 2026; and
- Provides various tax incentives and exemptions, including with respect to stamp tax, VAT, and corporate income tax, for investments in nuclear power plants.
Among these amendments, the expansion of the regulatory and administrative powers of the Cybersecurity Presidency, the restructuring of the allocation of powers concerning internet domain names and electronic communications, and the comprehensive transfer of duties from the ICTA to the Cybersecurity Presidency stand out as the changes most likely to have significant practical implications.
