Cyber Incident

Also known as: Cyber Attack, Siber Olay

In short

Under the Turkish Cybersecurity Law No. 7545, a breach of the confidentiality, integrity or availability of information systems or data, which must be reported to the Cybersecurity Directorate without delay.

A cyber incident is defined in the Cybersecurity Law No. 7545, which entered into force in 2025, as a breach of the confidentiality, integrity or availability of information systems or data. The definition is broad: locking systems with ransomware or making a service unavailable is a cyber incident just as much as data theft.

Who Must Report?

The Cybersecurity Law broadly covers persons and organisations operating in cyberspace and providing services, collecting, processing or storing data through information systems. It requires the persons and organisations within its scope to report vulnerabilities and cyber incidents they detect in their field of service to the Cybersecurity Directorate without delay.

Failure to report, or failure to take the measures required by the legislation, is subject to an administrative fine of TRY 1 million to TRY 10 million for 2025. See our Cybersecurity Compliance Programme for how we support companies with these obligations.

Relationship with Personal Data Breaches

Every personal data breach is also a cyber incident because it breaches the confidentiality of data; but not every cyber incident is a personal data breach. For example, an attack that only stops a company’s production systems without giving access to personal data is a cyber incident, not a personal data breach.

An incident affecting personal data may trigger two separate notification obligations: to the Personal Data Protection Board within 72 hours of becoming aware of the breach under the KVKK, and to the Cybersecurity Directorate without delay under the Cybersecurity Law. The two notifications must be consistent with each other. For the step-by-step process, see our guide Personal Data Breach: The First 72 Hours.

Preparation

Designate in advance who is responsible for responding to cyber incidents and who decides on notification,
Keep access and activity logs for incident detection and retain them for a defined period,
Prepare a response plan for IT, legal and communications teams to work together during an incident, and test it with drills,
Regularly test backups and recovery plans for critical services.

Frequently Asked Questions

Must every cyber incident also be notified under the KVKK?

No. Only incidents in which personal data is obtained by others through unlawful means are notified to the Board under the KVKK. An attack that gives no access to personal data is assessed only under the Cybersecurity Law.

How quickly must a cyber incident be reported?

The Cybersecurity Law requires cyber incidents to be reported without delay. If the same incident is also a personal data breach, the 72-hour deadline under the KVKK runs separately.

← Glossary A–Z