TURKEY: An Introduction to TMT
2024 was a dynamic year for Turkey, driven by key regulatory developments and economic recovery efforts. Despite ongoing economic struggles, exacerbated after the pandemic by its region’s geopolitical climate, Turkey remains committed to advancing its growth, with progress shown in economic trends and tech-related legislative achievements. Aspiring to become a regional tech hub, Turkey has been strengthening its legislative framework and governance structure to attract high-tech investments, particularly in cloud and datacenter, AI, mobility, software, fintech, semiconductors, communications and space technologies and digital structure in order to advance its leading defence industry. These efforts are supported by the government’s focus new incentive schemes and alignment with EU legislation.
The key development in 2024 was the long-awaited amendment to the Personal Data Protection Law (PDPL). Introduced in March, this reshaped the cross-border data transfer regime and established a multi-layered legal framework, largely aligning it with the General Data Protection Regulation (GDPR). The Polish Personal Data Protection Authority (KVKK) further expanded on the new regime by issuing a secondary regulation, a guideline, and standard contracts (Turkish SCCs). While the Turkish SCCs are consistent with EU SCCs, an additional notification requirement stipulated under PDPL led to 1,345 Turkish SCCs being submitted to the KVKK by the end of 2024, a number that continues to grow. The amendment also developed processing conditions for special categories of personal data, in line with the GDPR regime.
While Turkey has been positioning itself as an AI-development friendly country (as opposed to being pro-regulation), whether and how to regulate AI became one of the overriding themes of 2024 due to the sheer momentum behind AI legislation, particularly in the EU. Although AI remains one of the government’s priority sectors for incentives, the most notable signal from the legislative agenda came with the Medium-Term Program (2025-2027), which explicitly stated that necessary legislative work will be carried out to align the legislation with the EU AI Act. With respect to its timeline, the National AI Strategy Action Plan, revised in 2024 as a response to generative AI developments, suggested that legislative efforts would be finalised by the end of 2025, despite current progress pointing to a possible delay. Reflecting the increasing importance attached to AI, Parliament established a temporary Research Commission on AI (AI Commission) in October 2024 to explore AI’s societal impacts, identify steps to leverage its benefits, and assess regulatory options. Since commencing its work in February 2025, the AI Commission has been engaging with key stakeholders from public institutions, the private sector, and civil society. Its findings, to be submitted to Parliament, are expected to play a critical role in shaping Turkey’s AI regulatory framework.
In recent years, the Digital Medium Commission, tasked with reviewing and advising on digital regulations, has also become key. The Commission closely follows developments in the TMT sector, focusing on content moderation in social media and online broadcasting services, AI development and IP infringement, while meeting with leading industry players to understand their perspective and operations in the Turkish market. Meanwhile, judicial and administrative actions against online platforms on the grounds of protecting children have intensified in recent months, leading to the suspension of Roblox, Wattpad, and Discord services in the country until they implement effective content-moderation mechanisms. Calls for renewed content moderation, including age restrictions and verification on social media, have also been voiced by top government officials, with potential regulatory bans for certain age groups.
On the other hand, with the growing shift towards e-commerce and digital marketing, the Advertisement Board under the Ministry of Trade has increased its regulatory oversight of digital advertising activities. Following a recent amendment raising administrative fines for violating advertisements (up to TRY8.6 million for online ads), the Advertisement Board has intensified its focus on digital advertising practices, including discount campaigns, price display, dark patterns, unfair commercial practices and the responsibilities of intermediary service providers.
Another critical development has been seen in the field of cybersecurity, with the introduction of the Cybersecurity Law Proposal (still in the draft form as of 3 March 2025) and the establishment of the Cybersecurity Presidency. Although Turkey regards cybersecurity as an integral component of national security and has aligned its policies accordingly, the relevant requirements have not yet been consolidated under a unified legislative framework, but rather have been spread across various sector-specific regulations. The Cybersecurity Law Proposal, Turkey’s first formal effort to unify the cybersecurity framework, aims to: i) address the increasing complexities of cyber threats; ii) enhance the protection of digital assets for both individuals and organisations; and iii) provide the legal framework for the newly established regulatory and supervisory authority, the Cybersecurity Presidency. Expected to be enacted by March 2025, the Cybersecurity Law Proposal will likely impact both local and foreign players, particularly those providing cybersecurity services and critical infrastructure, and is set to become a major compliance factor in the coming years. Additionally, as it references secondary regulations for details, as stipulated in the government strategies, EU legislation is expected to play a significant role in shaping its implementation.
Another major development in 2024 was the enactment of the Law on Amendments to Capital Markets Law, which is known as the Crypto Law, in July. Crypto Law comprehensively regulates activities related to crypto-assets, including the introduction of a licensing requirement for crypto-asset service providers from the Capital Markets Board. Crypto Law also establishes a legal framework concerning the information systems to be deployed by crypto-asset service providers, while delegating the detailed requirements to secondary regulations. In this respect, the secondary regulations, in the draft form as of 3 March 2025, are expected to deeply affect those providing digital infrastructure for crypto-asset service providers.
Last year, Turkey reorganised its geographical data regulations to establish a new legal framework for operations involving such data. The previous regime, which was divided into two categories – geographical data permits and geographical data licenses – has been abolished. Now, only a geographical data permit is required from the Ministry for the collection, production, sharing, or sale of geographical data within the scope of National Geographical Data Responsibility Matrix. The definition of geographical data subject to the permit is broadly outlined as: “Data containing multiple location information, data which can be associated on a digital map base or with address data, data collected online or offline from the land by means of sensors specified in the data description document”; as such, any activity involving the processing of data containing location information from Turkey may be subject to the permit requirement.
The implementation of the amendment to the Law on the Regulation of E-Commerce, enacted in 2022, continues to make progress. Within this framework, efforts are focused on ensuring fairer relationships in e-commerce, particularly between intermediary service providers and service providers. The regulations aim to prevent certain e-commerce marketplaces from gaining a dominant market position while imposing stricter obligations on intermediary service providers, including restrictions on discount and advertising budgets, and the removal of unlawful content, including IP infringements. It is anticipated that revisions to the secondary regulations of this law will be introduced in 2025 to further refine these provisions.