Your text here

Guidelines on
Turkish IT Law
and Regulation

Table Of Contents

1. General Policy………………………3

2. Licensing Regime…………………...5

3. Spectrum Use……………………….7

4. Separation…………………………..9

Erkan
5. Platform Regulation……………….10

Attorney
6. Data Protection…………….……....11

7. Data Localization………………….12
Partnership
8. Cybersecurity……………….……..13
 1. General Policy

In Turkey, the communication sector is governed by a comprehensive regulatory framework

primarily outlined in Law No. 5809 on Electronic Communications. This law covers various
aspects of the communication sector, including the provision of electronic communication
services, the construction and operation of related infrastructure and network systems,
manufacturing and operation of electronic communication equipment, and the planning and
assignment of resources such as frequency. Additionally, several other laws and regulations,
including those related to internet broadcasting, electronic signature, e-commerce, network and
information security, personal data protection, consumer rights, authorization, identity
authentication, spectrum management, and access and interconnection, contribute to the
regulatory landscape.

The Information and Communication Technologies Authority (ICTA) enforces the decisions and
communiques prepared under these regulations, with general laws such as Capital Markets Law
No. 6362, Turkish Commercial Code No. 6102, and Criminal Procedural Law No. 5271 also
playing a role in governing the communications sector.

The Ministry of Transport and Infrastructure and ICTA share responsibilities under Law No.
5809, with ICTA mainly holding regulatory and executive powers, while the Ministry is
primarily responsible for policymaking. The Ministry plays a crucial role in setting strategies and
policies for electronic communication services, encouraging sector development, contributing to
the transformation into an information society, and planning electronic communication
infrastructure. It also represents the state in international associations, conducts necessary
research, and takes measures to ensure the continuity of electronic communications during
natural disasters or extraordinary situations.

On the other hand, ICTA is responsible for creating and protecting competition in the sector,
imposing obligations on operators with significant market power, inspecting breaches of
competition, safeguarding the rights of

2
subscribers and users, conducting dispute-resolution procedures, and supervising various aspects
such as frequency planning, numbering, and inspection of operators. ICTA also plays a vital role
in enforcing regulations, determining fees, inspecting service quality, and enacting by-laws and
communiques.

While there are no specific restrictions on foreign ownership in the communications law,
companies seeking authorization in the communications sector must be duly established as
limited liability or joint-stock companies under Turkish Commercial Law No. 6102. Foreign
entities or individuals are allowed to be the sole shareholders of such authorized companies.

3
 2. Licensing Regime

In Turkey, the IT licensing regime is governed by the Electronic Communications Law No.
5809. Companies intending to provide electronic communications services or operate networks
must notify the Information and Communication Technologies Authority (ICTA) before starting
their activities.

The authorization process can occur through notification or the granting of the right to use. The
key considerations include:

Authorization through Notification or Right to Use:

- Companies intending to provide electronic communications services or operate networks

need to notify ICTA of their plans using the Notification Form.
- If no scarce resources like numbers or frequencies are required, authorization is granted
through notification to ICTA.
- If the company requires scarce resources, it obtains authorization by receiving the right of
use from ICTA.

Right of Use Application Forms:

- Applications for electronic communications services are submitted through Right of Use
Application Forms.
- ICTA issues the right of use within 30 days upon a valid application, and there's no
limitation on the number of rights of use.

Amendments and Information Requirements:

4
 - Recent amendments (ICTA Decision No. 2021/DK-YED/80) introduced changes to the
Notification Form and the Application Form for the Right of Usage.
- Expanded information requirements include company details, target audience,
infrastructure definition, network architecture, satellites to be used, planned service start
time, connection needs between networks, and requested frequency channels and
numbers.

Qualification Control and Renewal:

- Operators authorized through notification undergo qualification control periods.

- Operators authorized with an unlimited number of usage rights undergo authorization
renewal every 12 to six months.
- Criteria for renewal include having necessary personnel, meeting subscriber or net sales
targets, active service provision, and compliance with authorization legislation.

Authorization Fees:

Stipulated by the Regulation on Authorization for Electronic Communications Sector.

Notification process requires an administrative fee of 0.35% of yearly net sales.
Right-of-use process involves specific fees for relevant resources, plus the administrative fee.
Minimum fees for the right of use are determined by the Board of Ministers based on ICTA's
proposal and the Ministry's resolution.

Spectrum for Mobile Services (4G, 4.5G, 5G):

- No distinct regulation currently for 4G, 4.5G, and 5G.

- 5G spectrum granted through right-of-use tenders, with the first signal expected for
citizens in 2023.

5
 3. Spectrum Use

In Turkey, the legal regime regulating spectrum use is primarily governed by the Spectrum
Management Regulation, as published in the Official Gazette.

Key Regulation:
The Spectrum Management Regulation, published on July 2, 2009, is the main legislation
overseeing spectrum management in Turkey.

Regulation's Scope:

 It outlines procedures for managing, allocating, assigning, coordinating nationally and

internationally, and registering radio frequencies.
 The regulation addresses the withdrawal and reassignment of frequencies, ensuring
efficient and effective spectrum utilization.

License Permitted Use:

 Spectrum licenses specify the permitted use of the licensed spectrum.

 The scope of permitted use is typically determined within these licenses.

Management Principles:

 ICTA (Information and Communication Technologies Authority) manages spectrum

allocation.
 Attention is given to ensuring effective competition, transparency, and avoiding
discrimination in the allocation process.

International Coordination:

6
  Planning aligns with decisions of international organizations like the International
Telecommunication Union, European Union, etc.
 Frequencies are assigned to operators based on authorizations, and the duration is
specified in the certificate of authorization.

Trading Spectrum:

 Trading of licensed radio-frequency spectrum is not prohibited.

 Spectrum license trading is allowed, but transfer requires approval from ICTA.
 ICTA evaluates applications, considering market conditions and competition.
 Upon approval, a right of use is granted to the transferee operator within one month.

In essence, the legal framework aims to manage spectrum allocation effectively, ensuring fair
competition, transparency, and compliance with international standards.

7
 4. Structural or Functional Separation

In accordance with Law No. 5809 on Electronic Communications in Turkey, the Information and
Communication Technologies Authority (ICTA) is empowered, under Article 6, to investigate
and address any violations of competition within the electronic communications sector.
This includes imposing sanctions and seeking the opinion of the Competition Authority when
competition breaches are identified.

Furthermore, as outlined in Article 7 of the same law, the Competition Board, when conducting
examinations and making decisions related to the electronic communications sector, especially in
matters of mergers and takeovers, gives paramount consideration to the views expressed by
ICTA and its regulatory procedures.

Illustrating this regulatory framework, a specific example in the Competition Authority's Review
Report on Financial Technologies in Payment Services highlights ICTA's role in introducing
regulations. These regulations create an obligation for established operators to share their
infrastructure with other operators under specific conditions. This approach aims to facilitate
market entry for new enterprises, providing residents with alternative channels to reach
customers through vertical contracts.

8
 5. Platform Regulation

Various laws and regulations govern digital platform providers in Turkey. Law No. 5809 on
Electronic Communications addresses digital platforms offering services through satellite
broadcasting, while Law No. 6563 on the Regulation of Electronic Commerce outlines rules for
electronic commerce platforms and digital marketing. Law No. 4054 on the Protection of
Competition applies to digital platform markets, and Law No. 5651 on Regulating Broadcasting
on the Internet and Fighting Against Crimes Committed through Internet Broadcasting restricts
certain content on the internet.

With the enactment of Law No. 7253, amending the Law on Regulation of Publications on the
Internet and Combating Crimes Committed through Such Publication, amendments were
introduced, particularly focusing on social-media networks. These changes aimed to impose
responsibilities on both social-networking platforms and states to combat illegal content.

Law No. 5651 now includes the definition of 'social-network provider,' encompassing entities
enabling users to create, view, or share content for social interaction. Hosting providers, under
the law, must retain specific traffic information, and the option to decide on content removal, in
addition to blocking access, has been introduced.

Foreign social-network providers accessed by over one million daily users are required to
appoint a representative in Turkey for official notifications and requests. Failure to comply may
result in sanctions such as administrative fines, advertising bans, and reduced internet traffic
bandwidth. Providers, both domestic and foreign, with over one million daily users must take
measures to retain data in Turkey for users located there.

9
Notably, social-network providers are liable for compensating damages arising from content
deemed illegal by a court decision if they fail to remove or block access within 24 hours after
notification.

6. Data Protection

Data protection in the electronic communications sector in Turkey is primarily governed by Law
No. 5809 on Electronic Communications and the Regulation on Processing of Personal Data and
the Protection of Privacy in the Electronic Communications Sector. These specific laws and
regulations impose obligations on operators to safeguard subscribers' information and privacy.

Operators are prohibited from listening to, recording, storing, intercepting, or tracking
communication without explicit consent from all relevant parties, except when required by
legislation or judicial decisions. Additionally, operators must inform data subjects about data
processing activities based on their explicit consent every third quarter, and if no notification is
made, the processing activity must cease.

To ensure national security, the transfer of traffic and location data abroad is restricted.
Operators are obligated to implement technical and administrative measures for network and
personal data security, maintain transaction records related to personal data access, and comply
with the general rules and procedures for data protection under the Law on Personal Data
Protection.

In cases of data breaches, operators must notify both the Personal Data Protection Authority and
the Information and Communication Technologies Authority (ICTA). Failure to fulfill these
obligations may result in administrative fines ranging from 1% to 3% of the operator's net sales
from the previous calendar year, as stipulated by the ICTA Administrative Sanctions Regulation.

10
 7. Data Localization

In accordance with Law No. 5809 on Electronic Communications in Turkey, the transmission of
customer data abroad is strictly regulated and requires the explicit consent of the customer. This
legal provision aims to safeguard the privacy and security of customer information.

Furthermore, the Regulation on Processing of Personal Data and Protection of Privacy in the
Electronic Communications Sector, published in the Official Gazette No. 31324 on December 4,
2020, reinforces the requirement for customer consent before transferring data to third parties
located abroad. When seeking consent, operators are obligated to inform customers about crucial
details such as the destination country of the data, the scope and duration of data retention, and
the relevant legislation and practices applicable in the receiving country.

In addition to sector-specific regulations, operators are also bound by Law No. 6698 on Personal
Data Protection. This broader legislation sets forth general rules, principles, and procedures for
the processing and protection of personal data. As a result, operators must adhere to the
requirements outlined in both Law No. 5809 and Law No. 6698 to ensure lawful and secure data
transfers while respecting individuals' privacy rights.

11
 8. Cybersecurity

In Turkey, the Council of Ministers' Decision on Conducting, Managing, and Coordinating

National Cybersecurity Activities, effective since October 20, 2012, represents a significant
legislative development in the realm of cybersecurity. This decision led to the establishment of
the Cybersecurity Board, tasked with approving policies, strategies, and action plans related to
cybersecurity, as well as overseeing their nationwide implementation. The board also plays a role
in identifying critical infrastructure and determining institutions exempt from certain
cybersecurity provisions.

Moreover, the Information and Communication Technologies Authority (ICTA) has outlined
cybersecurity objectives in its 2022 Business Plan and 2019–2023 Strategic Plan. These
objectives include ongoing operational activities to ensure national cybersecurity, participation in
national and international exercises, workshops with cyber incident response teams, assessment
of critical infrastructure expansion, and the development of software for technological measures.

In the electronic communication sector, specific cybersecurity provisions are governed by the
Regulation on Network and Information Security in the Electronic Communication Sector. This
secondary regulation focuses on technical, administrative, organizational, and physical measures
that operators in the sector must implement. It's important to note that this regulation does not
cover personal data processing and protection, which is addressed by separate legislation.

Under the Regulation on Administrative Sanctions issued by ICTA, failure to comply with
obligations related to network and information security and cybersecurity measures may result in
administrative fines ranging from

12
1,000 to 1 million Turkish lira for individuals or legal entities. This regulatory framework
underscores the importance of maintaining robust cybersecurity practices in the electronic
communication sector in Turkey.

13
This information is provided for your convenience and does not constitute legal advice. It is
prepared for the general information of our clients and other interested persons. This should
not be acted upon in any specific situation without appropriate legal advice and it may include
links to websites other than the website.

Erkan Attorney Partnership has no responsibility for any websites other than its own and does
not endorse the information, content, presentation or accuracy, or make any warranty, express
or implied, regarding any other website. This information is protected by copyright and may
not be reproduced or translated without the prior written permission of Erkan Attorney
Partnership.
© 2023 Erkan LLP

14