Introduction
Smart city projects in Turkey are no longer limited to traffic lights, municipal mobile applications or digital kiosks. They now include connected transportation systems, smart parking, intelligent lighting, environmental sensors, waste management systems, surveillance infrastructure, emergency response networks, public Wi-Fi, 5G use cases, IoT platforms, data centers, cloud systems, smart grids, connected public transport, digital twin platforms and artificial intelligence-based municipal decision systems.
Because these projects depend on connectivity, data and communications infrastructure, telecommunications law is at the center of smart city compliance in Turkey. A smart city project may involve fiber networks, mobile networks, radio equipment, SIM or eSIM connectivity, IoT devices, public Wi-Fi, cloud communication services, data processing, municipal rights of way, facility sharing, cybersecurity, public procurement and consumer-facing digital services.
Turkey’s smart city policy framework has become more structured in recent years. The Ministry of Environment, Urbanization and Climate Change’s 2024–2030 National Smart Cities Strategy and Action Plan materials describe a vision built around advanced society, advanced technology, sustainability and resilience. This policy direction shows that smart city investments are not only technology projects; they are also public infrastructure, urban governance and legal compliance projects.
The main telecommunications law framework is Law No. 5809 on Electronic Communications and the regulatory practice of the Information and Communication Technologies Authority, known as BTK. BTK explains that electronic communications, electronic communications infrastructure, operation of infrastructure, electronic communications services and electronic communications networks may be carried out by obtaining authorization from the Authority. Therefore, every smart city project should be legally classified before implementation: is it merely a municipal technology procurement, or does it involve provision or operation of electronic communications services or infrastructure?
What Is a Smart City Project?
A smart city project uses technology, data, sensors, connectivity and software to improve urban services, sustainability, safety, mobility, energy efficiency, resource management and citizen experience. In practical terms, smart city projects may include:
Smart traffic management.
Smart parking sensors.
Public transport tracking.
Digital bus stops.
Smart street lighting.
Environmental monitoring.
Air quality sensors.
Noise monitoring.
Flood and earthquake early warning systems.
Public Wi-Fi networks.
Municipal mobile applications.
Smart waste collection.
Smart water metering.
Smart energy grids.
Smart buildings.
Urban camera systems.
Emergency communication networks.
IoT-based infrastructure monitoring.
Digital twin platforms.
AI-supported municipal decision systems.
Citizen communication platforms.
From a legal perspective, a smart city project becomes more complex when it collects data, uses communication networks, connects many devices, uses public property, stores personal data, involves private-sector operators or provides digital services to citizens.
The legal question is not simply whether the city becomes “smart.” The correct legal question is: who owns the infrastructure, who operates the network, who processes the data, who is authorized by BTK, who is responsible for cybersecurity, and who is liable if the system fails?
Why Telecommunications Law Matters in Smart Cities
Smart city projects depend on connectivity. Sensors must transmit data. Cameras must connect to control centers. Public transport devices must communicate with platforms. Smart lighting systems must receive commands. Public Wi-Fi must connect citizens to the internet. Emergency systems must operate during disasters. 5G and fiber networks must support high-capacity urban services.
BTK’s “Services Subject to Authorization” guidance defines electronic communications infrastructure broadly and explains that electronic communications networks and infrastructure operations may require authorization. This is crucial for smart cities because many municipal technology projects include communication layers that may cross into regulated telecom activities.
For example, a municipality that simply purchases smart lighting devices from a vendor may not necessarily become a telecom operator. But if a municipal company establishes fiber infrastructure and leases capacity to third parties, operates a public wireless network, provides internet access or offers connectivity services to other entities, BTK authorization analysis becomes necessary.
Telecommunications law matters for smart cities because it determines:
Whether BTK authorization is required.
Whether spectrum or frequency use is lawful.
Whether public Wi-Fi rules apply.
Whether right-of-way permissions are needed.
Whether facility sharing obligations apply.
Whether network security duties arise.
Whether consumer or end-user rights are triggered.
Whether telecom data must be retained or protected.
Whether equipment must satisfy radio device rules.
Whether municipal and private actors need separate contracts.
A smart city project without telecom compliance may work technically but fail legally.
BTK Authorization and Smart City Connectivity
A key issue in smart city projects is whether the relevant actor must obtain BTK authorization. Authorization depends on the service model. A municipality, municipal company, technology vendor, ISP, telecom operator or infrastructure company may each have different roles.
If the project involves operating electronic communications infrastructure, providing internet access, leasing telecom infrastructure, offering data transmission services, running a public Wi-Fi network or enabling third-party connectivity, BTK authorization should be reviewed. BTK’s CEVHER guidance states that initial authorization, additional authorization, renewal, adequacy procedures and operator information updates are conducted through the CEVHER System.
This is especially important for municipal subsidiaries. Many municipalities in Turkey establish companies for technology, telecom, infrastructure or urban service projects. If such a company provides electronic communications services or operates infrastructure, it may need to satisfy BTK requirements regarding company structure, articles of association, capital, management eligibility and authorization scope.
A legally safe smart city project should clearly define whether the connectivity layer will be provided by an already authorized operator or by a new entity seeking authorization. If an authorized operator provides all telecom connectivity and the municipality merely uses the service, the regulatory burden is different from a model where the municipality or vendor operates connectivity infrastructure itself.
Fiber Infrastructure in Smart City Projects
Fiber infrastructure is the backbone of most large smart city projects. Traffic cameras, urban command centers, 5G backhaul, municipal data centers, public Wi-Fi hotspots, smart transport systems and emergency networks all require reliable high-capacity connectivity.
A fiber-based smart city project may require route planning, municipal excavation permits, right-of-way agreements, facility sharing analysis, infrastructure records, maintenance contracts and restoration obligations. In Turkey, facility sharing is particularly important because BTK describes it as access to passive infrastructure such as pipes, ducts and poles owned by electronic communications network operators, emphasizing that sharing existing facilities is important for efficient resource use and avoiding duplicate investments.
Smart city fiber planning should therefore avoid unnecessary duplicate excavation. Before digging new routes, project owners should assess existing ducts, poles, fiber routes, municipal utility corridors and operator infrastructure. This reduces cost, limits urban disruption and improves regulatory defensibility.
Fiber contracts should address route ownership, access rights, maintenance responsibility, outage repair time, relocation, facility sharing requests, municipal restoration obligations and liability for damage to public utilities.
Right of Way and Municipal Permissions
Right of way is one of the most important legal issues in smart city telecommunications projects. Smart city infrastructure often uses public roads, sidewalks, lighting poles, traffic signal systems, bus stops, bridges, tunnels, metro stations, public buildings and underground utility corridors.
Turkish right-of-way rules define the right to pass electronic communications infrastructure through public or private property for purposes such as establishing, maintaining and repairing electronic communications networks. Where a smart city project involves telecom cabling, ducts, poles or antenna infrastructure, right-of-way and property access must be carefully documented.
Municipal involvement can create both opportunities and legal questions. A municipality may own roads, poles, public buildings and other infrastructure. However, municipal ownership of urban assets does not automatically eliminate telecom regulatory requirements. If an operator uses municipal property to provide electronic communications services, the relationship should be supported by lawful permissions, contracts and technical rules.
Smart city right-of-way documentation should specify:
Which assets may be used.
Who may install equipment.
Who owns installed equipment.
Who pays installation costs.
Who maintains infrastructure.
Who bears liability for public damage.
How equipment is removed.
How route relocation is handled.
How third-party operators may request access.
How public safety is protected.
A project that ignores these issues may face disputes years later when assets must be expanded, relocated or shared.
5G and Smart Cities in Turkey
5G is a major enabler of smart city services. Low latency, high capacity and massive machine-type communication can support connected vehicles, smart traffic systems, remote monitoring, public safety applications, industrial zones, smart ports, autonomous systems and real-time urban analytics.
Turkey completed its 5G tender on 16 October 2025. BTK announced that three operators submitted bids for 11 frequency packages in the 700 MHz and 3.5 GHz bands, and the total tender amount reached USD 2.945 billion before VAT. BTK’s announcement also stated that 5G would start being used as of 1 April 2026.
For smart city projects, this development is important because 5G creates new urban connectivity options. Municipalities and vendors may design 5G-supported applications in transportation, emergency response, energy, environmental monitoring and public safety. However, 5G use does not remove the need for legal compliance. Spectrum use is regulated, and smart city actors must generally work with authorized mobile operators unless they have a lawful private network or other permitted structure.
5G smart city contracts should define network coverage, latency, availability, data flows, cybersecurity, service levels, device compatibility, emergency priority, outage response and liability. Where mission-critical services are involved, ordinary commercial mobile service may not be enough; stronger service-level commitments may be required.
IoT and M2M Connectivity
Smart city projects often depend on IoT and machine-to-machine communication. Sensors, meters, traffic devices, cameras, waste containers, lighting controllers, vehicle trackers and environmental devices may all send data through mobile networks, LPWAN, Wi-Fi, fiber, radio links or private networks.
IoT projects raise several telecom law questions:
Who provides connectivity?
Are SIM or eSIM profiles used?
Is the service provided by an authorized operator?
Are devices using lawful frequency bands?
Does the project involve public internet access?
Is data transmitted through foreign platforms?
Are device identifiers and location data personal data?
Who is responsible for cybersecurity?
Can the system operate during disasters?
A municipal IoT project should not treat connectivity as a minor technical procurement item. Connectivity is often the legal and operational foundation of the entire project. If devices cannot lawfully communicate, the smart city service may fail.
IoT contracts should include clauses on device activation, SIM ownership, connectivity provider, data usage limits, roaming restrictions, device replacement, maintenance, encryption, cybersecurity, data retention and emergency service continuity.
Public Wi-Fi in Smart City Projects
Public Wi-Fi is a common smart city service. Municipalities may provide Wi-Fi in parks, squares, public transport, libraries, youth centers, municipal buildings, beaches or cultural areas. However, public Wi-Fi creates legal obligations under internet regulation, data protection and cybersecurity rules.
A public Wi-Fi provider may need to identify users, retain access logs, prevent unlawful use, implement filtering measures where required and protect personal data. Public Wi-Fi may also trigger Law No. 5651 obligations depending on the role of the provider.
From a smart city perspective, public Wi-Fi should be designed with privacy and proportionality. Municipalities should avoid excessive data collection, unnecessary tracking, hidden advertising consent or unclear sharing of user data with third-party vendors. A privacy notice should explain what data is collected, why, for how long, with whom it is shared and how users may exercise their rights.
Public Wi-Fi contracts should address:
Legal role of the municipality and vendor.
User identity verification.
Log retention.
Cybersecurity.
Content filtering where required.
KVKK compliance.
Commercial communication consent.
Advertising use.
Access for minors.
Incident response.
Liability for unlawful use.
A free public Wi-Fi service may still create serious legal exposure if it is poorly designed.
Smart City Data and KVKK
Smart city projects are data-intensive. They may collect vehicle movements, public transport usage, parking behavior, Wi-Fi login data, camera images, license plate data, device identifiers, mobile application data, location data, energy consumption, water usage, citizen complaints, payment information and environmental data.
KVKK defines personal data broadly and sets basic processing principles. Personal data must be processed lawfully, fairly, accurately, for specific and legitimate purposes, in a relevant and proportionate manner, and retained only as long as necessary.
This means that smart city data governance cannot be an afterthought. A municipality or vendor cannot collect all available data merely because the technology allows it. Each data processing activity must have a purpose, legal basis, retention period, access control and security measure.
In smart city projects, common KVKK risks include:
Excessive camera surveillance.
Unclear facial recognition use.
Unnecessary location tracking.
Combining datasets for unrelated purposes.
Sharing citizen data with vendors without proper contracts.
Using Wi-Fi data for advertising without valid consent.
Storing data indefinitely.
Weak cybersecurity.
Unclear data controller and processor roles.
Failure to provide privacy notices.
Smart city projects should begin with a data mapping exercise before procurement or deployment.
Data Controller and Data Processor Roles
One of the most difficult issues in smart city projects is identifying who is the data controller. The municipality may define the purpose of the project, but a vendor may operate the platform, store data, analyze information and provide dashboards. A telecom operator may transmit data but may also process network-related data for its own legal obligations. A cloud provider may host the system. A subcontractor may maintain devices.
The contract must define whether each party is a data controller, joint controller or data processor. Incorrect classification may create legal risk. If the vendor uses municipal data for its own analytics, product development or marketing, it may become a controller for those purposes. If the municipality determines all purposes and the vendor acts only under instructions, the vendor may be a processor.
A smart city data processing agreement should include:
Subject matter of processing.
Data categories.
Data subject categories.
Processing purposes.
Security measures.
Subprocessor rules.
Cross-border transfer restrictions.
Retention and deletion.
Audit rights.
Breach notification.
Assistance with data subject requests.
End-of-contract data return.
No secondary use without authorization.
Cybersecurity and Network Security
Smart city projects are attractive targets for cyberattacks. A successful attack may disable traffic lights, disrupt public transport, expose camera footage, manipulate sensors, block municipal services, affect water or energy systems, leak citizen data or cause public safety risks.
BTK’s network and information security materials explain that Law No. 5809, authorization regulations and operator agreements include obligations on network and information security. BTK also states that operators may be audited financially, technically, legally and administratively for compliance, and sanctions may be imposed for non-compliance.
Smart city cybersecurity should cover both network and application layers. Devices, gateways, SIMs, servers, APIs, dashboards, mobile applications, cloud systems, control centers and administrative accounts must all be protected.
Cybersecurity measures should include:
Encryption.
Network segmentation.
Secure device provisioning.
Strong authentication.
Patch management.
Secure APIs.
Logging and monitoring.
Incident response plan.
Disaster recovery.
Vendor security audits.
Penetration testing.
Backup systems.
Physical device security.
Role-based access control.
Business continuity planning.
For mission-critical urban systems, cybersecurity should be treated as a public safety requirement, not only as an IT feature.
Radio Equipment and Device Compliance
Smart city projects use many wireless devices, including sensors, gateways, cameras, smart meters, routers, antennas, Bluetooth devices, Wi-Fi access points, radio modules, traffic devices, smart lighting controllers and IoT terminals. These devices may be subject to radio equipment compliance rules.
Turkey’s Radio Equipment Regulation is aligned with the EU Radio Equipment Directive. BTK explains that the Turkish Radio Equipment Regulation was published in the Official Gazette dated 5 November 2020 and entered into force after a transition period.
Because the previous citation marker is not available in this response context, the practical legal point should be stated carefully: imported or locally supplied radio devices used in smart city projects should be checked for CE marking, Declaration of Conformity, lawful frequency use, technical documentation, Turkish market labeling and BTK market surveillance risk.
In procurement documents, municipalities should require vendors to provide compliance files for all radio equipment. A low-cost sensor may create serious legal and operational risk if it uses an unauthorized frequency band or causes interference.
Public Procurement and Municipal Partnerships
Most smart city projects are implemented through public procurement, concession-like models, service procurement, build-operate structures, revenue-sharing agreements, public-private partnerships or municipal company contracts. The legal model affects ownership, liability, data control, intellectual property, termination, financing and public audit.
Public procurement documents should be drafted carefully. A vague technical specification may lead to vendor lock-in, weak cybersecurity, poor data rights, high maintenance costs or inability to integrate with future systems.
Smart city procurement should include:
Clear technical scope.
Telecom compliance requirements.
BTK authorization responsibility.
Device compliance obligations.
Data ownership and access rights.
KVKK compliance.
Cybersecurity standards.
Service-level commitments.
Interoperability requirements.
Open API rules.
Source code or escrow where needed.
Maintenance and update obligations.
Exit and migration rights.
Disaster recovery.
Audit rights.
Penalty clauses.
Public service continuity.
A municipality should avoid becoming dependent on a single vendor that controls all data, software, devices and interfaces without exit rights.
Smart City Contracts and Allocation of Liability
Smart city contracts should allocate legal and operational responsibility clearly. If a traffic management system fails, who is liable? If personal data is leaked, who notifies KVKK? If a public Wi-Fi user commits a crime, who preserves logs? If a sensor network causes interference, who responds to BTK? If a fiber route is damaged, who repairs it? If a cloud platform goes down, who compensates the municipality?
The contract should not merely describe the technology. It should allocate risk.
Key clauses include:
Regulatory compliance.
BTK authorization responsibility.
Right-of-way and permits.
Equipment conformity.
Data controller and processor roles.
Cybersecurity obligations.
Incident notification.
Service levels.
Uptime guarantees.
Maintenance.
Subcontractors.
Insurance.
Indemnity.
Public audit cooperation.
Intellectual property.
Data portability.
Termination assistance.
Confidentiality.
Force majeure.
Regulatory change.
For long-term projects, regulatory change clauses are especially important because telecom, data protection, cybersecurity and AI rules may evolve during the contract term.
Artificial Intelligence and Smart City Analytics
Many smart city systems now use artificial intelligence. AI may be used for traffic optimization, waste route planning, predictive maintenance, energy efficiency, security alerts, crowd analysis, parking enforcement or citizen service chatbots.
AI creates additional legal risks. If AI analyzes personal data, KVKK applies. If AI uses camera footage or location data, privacy risk increases. If AI makes decisions affecting citizens, transparency and accountability become essential. If AI predicts enforcement targets or public safety risks, discrimination and due process concerns may arise.
Smart city AI systems should be designed around:
Purpose limitation.
Human oversight.
Transparency.
Auditability.
Bias testing.
Data minimization.
Security.
Explainability where needed.
Contractual accountability.
No unauthorized secondary use.
Municipalities should avoid purchasing “black box” AI systems without understanding how data is processed, how outputs are generated and who is responsible for errors.
Smart City Platforms and Interoperability
A common problem in smart city projects is platform fragmentation. Different departments may purchase separate systems for transportation, waste, energy, lighting, security and citizen services. If these systems cannot communicate, the city may face inefficiency and vendor lock-in.
Interoperability should be a legal and technical requirement. Contracts should require documented APIs, data export, standard formats, integration support and migration assistance. The municipality should own or at least have lawful access to project data in usable formats.
Interoperability also matters for telecom compliance. A public Wi-Fi system, traffic sensor platform and emergency communication system may use the same fiber or mobile infrastructure. If contracts are not coordinated, service quality and liability may become unclear.
Smart City Data Centers and Cloud Use
Smart city projects often depend on data centers and cloud platforms. Municipal data, camera records, IoT data, citizen application records and operational dashboards may be stored centrally. If foreign cloud services are used, cross-border data transfer and public-sector data governance must be reviewed.
For telecommunications-related smart city projects, data center connectivity, backup routes, disaster recovery, physical security, uptime and cybersecurity are critical. A city cannot rely on a single fragile cloud system for emergency or transport operations.
Cloud and data center contracts should include:
Data location.
Backup location.
Disaster recovery.
Access controls.
Encryption.
Audit rights.
Incident notification.
Data deletion.
Subprocessor control.
Exit assistance.
Service continuity.
Government request handling.
KVKK compliance.
Emergency Communication and Resilience
Smart city projects should improve urban resilience. Flood warning systems, earthquake response networks, emergency public alerts, traffic routing during disasters, backup power, redundant communication paths and resilient data centers are essential.
The 5G and fiber infrastructure layer must be designed for resilience. If a system works only during normal conditions but fails during disasters, its public value is limited.
Legal contracts should require:
Backup connectivity.
Alternative power supply.
Disaster recovery tests.
Emergency priority procedures.
Manual override options.
Local fallback operation.
Incident reporting.
Regular drills.
Coordination with public authorities.
Public warning obligations.
Smart city resilience is not only technical; it is also contractual and regulatory.
Citizen Rights and Digital Inclusion
Smart city projects should not exclude citizens. Digital services must be accessible to elderly persons, disabled persons, low-income groups, foreign residents and people without smartphones. A municipality should not make essential services available only through a mobile application unless alternative channels exist.
Digital inclusion is a legal and ethical issue. Smart city services should be designed with accessibility, language support, physical service alternatives, transparent information and complaint channels.
For example, a smart parking application should not make it impossible for a person without a smartphone to park lawfully. A public transport application should not be the only way to access essential route information. A digital complaint system should not replace all offline access.
Legal Risks in Smart City Projects
The main legal risks include:
Lack of BTK authorization.
Unlawful operation of telecom infrastructure.
Invalid right-of-way arrangements.
Improper use of municipal assets.
Unlawful public Wi-Fi operation.
Non-compliant radio equipment.
Unauthorized frequency use.
Weak cybersecurity.
Unclear data controller roles.
Excessive personal data processing.
Unlawful camera or location tracking.
Cross-border data transfer problems.
Vendor lock-in.
Poor service-level drafting.
Public procurement disputes.
Lack of interoperability.
Unclear ownership of infrastructure.
Inadequate disaster recovery.
Failure to handle citizen complaints.
These risks should be addressed before procurement and deployment, not after problems arise.
Practical Compliance Checklist for Municipalities
Municipalities should follow this checklist:
Define the smart city service clearly.
Map all connectivity layers.
Identify whether BTK authorization is required.
Work with authorized telecom operators where needed.
Review right-of-way and municipal asset use.
Require facility sharing analysis.
Check radio equipment compliance.
Map all personal data processing.
Prepare privacy notices.
Define data controller and processor roles.
Require cybersecurity standards.
Include incident response obligations.
Ensure public procurement compliance.
Avoid vendor lock-in.
Require interoperability and data portability.
Set service-level commitments.
Prepare citizen complaint channels.
Plan for disaster resilience.
Keep audit-ready project files.
Practical Compliance Checklist for Vendors
Technology vendors should:
Classify telecom-related activities.
Determine whether authorization is needed.
Partner with authorized operators if necessary.
Provide device compliance documents.
Use lawful frequency bands.
Prepare KVKK-compliant data processing documents.
Implement cybersecurity controls.
Avoid unauthorized secondary use of municipal data.
Offer interoperable APIs.
Maintain service-level commitments.
Prepare incident response procedures.
Support public audit requirements.
Provide exit and migration assistance.
Maintain insurance.
Train personnel on public-sector data handling.
Practical Compliance Checklist for Telecom Operators
Telecom operators in smart city projects should:
Confirm authorization scope.
Define network services clearly.
Set SLA terms.
Protect network security.
Coordinate right-of-way use.
Review facility sharing obligations.
Secure IoT connectivity.
Clarify SIM/eSIM ownership.
Support lawful data processing.
Separate telecom data from municipal application data.
Prepare outage and emergency response procedures.
Maintain regulatory records.
Support BTK audits where relevant.
Conclusion
Smart city projects in Turkey sit at the intersection of urban governance, telecommunications law, data protection, cybersecurity, public procurement and technology contracts. A successful smart city project is not only innovative; it must also be lawful, secure, interoperable, accountable and resilient.
The legal foundation begins with correct classification. If a project involves electronic communications services, infrastructure operation, public Wi-Fi, IoT connectivity, fiber networks, 5G use cases or data transmission, BTK authorization and telecom compliance must be reviewed. BTK’s authorization framework and CEVHER system are central for entities that provide or operate regulated electronic communications services or infrastructure.
Turkey’s 2024–2030 smart city policy direction emphasizes advanced technology, sustainability and resilience. The legal framework must support that vision by ensuring lawful infrastructure, responsible data governance, strong cybersecurity, citizen rights, transparent procurement and effective public-private cooperation.
For municipalities, the most important step is to include legal compliance in the design stage. For vendors, the key is to avoid treating telecom, data and cybersecurity obligations as secondary issues. For telecom operators, smart city projects create opportunities but also require careful authorization, network security and service-level planning.
A legally sound smart city project in Turkey should combine BTK compliance, right-of-way documentation, facility sharing analysis, radio equipment conformity, KVKK governance, cybersecurity controls, public procurement discipline, strong contracts and citizen-focused service design. When these elements are properly integrated, smart cities can deliver safer, more efficient and more sustainable urban services without creating hidden legal risks.
Frequently Asked Questions
Do smart city projects require BTK authorization in Turkey?
They may require BTK authorization if the project involves providing electronic communications services, operating electronic communications infrastructure, public Wi-Fi, data transmission or connectivity services. BTK states that electronic communications services, networks and infrastructure operations may be carried out by obtaining authorization from the Authority.
Can a municipality operate its own telecom infrastructure?
A municipality or municipal company must review BTK authorization rules if it operates telecom infrastructure or provides electronic communications services. If an authorized telecom operator provides the connectivity layer, the municipality’s role may be different.
Why is fiber infrastructure important for smart cities?
Fiber infrastructure supports traffic systems, public Wi-Fi, 5G backhaul, municipal data centers, camera networks, emergency systems and high-capacity urban platforms. Facility sharing is important because BTK emphasizes efficient use of passive infrastructure such as ducts, pipes and poles.
What is the role of 5G in Turkish smart cities?
5G can support low-latency and high-capacity smart city services such as connected transport, emergency systems, IoT, public safety and real-time analytics. Turkey completed its 5G tender on 16 October 2025, and BTK stated that 5G would start being used as of 1 April 2026.
Does KVKK apply to smart city projects?
Yes. Smart city projects may process personal data such as camera images, location data, Wi-Fi login records, license plate data, mobile application data and citizen complaints. KVKK principles on lawful, specific, proportionate and limited processing apply.
Who is the data controller in a smart city project?
It depends on the project. The municipality may be the controller if it determines the purpose and means of processing. A vendor may be a processor or, in some cases, an independent or joint controller if it uses data for its own purposes.
Are smart city IoT devices subject to telecom rules?
They may be. IoT devices using SIM, eSIM, public mobile networks, radio frequencies, Wi-Fi or other connectivity systems may trigger telecom authorization, spectrum, device compliance and data protection issues.
What are the biggest cybersecurity risks in smart cities?
The biggest risks include unauthorized access to control systems, camera leaks, manipulation of traffic systems, IoT device compromise, ransomware, data breaches, weak APIs, vendor access abuse and lack of disaster recovery.
What should be included in smart city contracts?
Smart city contracts should include BTK compliance, device conformity, data protection, cybersecurity, service levels, right-of-way, ownership, maintenance, audit rights, incident response, interoperability, exit assistance and liability clauses.
What is the biggest legal risk in smart city projects in Turkey?
The biggest risk is launching a technically attractive project without proper legal classification. If telecom authorization, KVKK, cybersecurity, right-of-way, public procurement and contract risks are not addressed at the design stage, the project may face serious regulatory, financial and operational problems.
No Responses