Introduction
Cybersecurity obligations for telecom companies in Turkey have become one of the most important compliance areas in the electronic communications sector. Telecom operators, internet service providers, mobile network operators, fixed-line service providers, infrastructure operators, satellite communication providers, virtual mobile network operators, data center operators, cloud communication providers, and companies offering connectivity-based digital services are exposed to significant cybersecurity risks.
The telecommunications sector is a critical part of national digital infrastructure. Mobile networks, fiber infrastructure, internet backbones, routing systems, DNS infrastructure, data centers, satellite communication systems, base stations, customer management systems, billing platforms, traffic data systems, and emergency communication services affect not only private users but also public institutions, financial systems, healthcare services, transportation, energy, education, e-commerce, and national security.
For this reason, cybersecurity is not merely a technical issue for telecom companies in Turkey. It is a legal, regulatory, operational, and corporate governance obligation. Telecom companies must comply with the Electronic Communications Law No. 5809, BTK regulations, network and information security obligations, Cybersecurity Law No. 7545, personal data protection law, consumer protection rules, sectoral incident response requirements, and administrative audit obligations.
The Information and Communication Technologies Authority, known as BTK, is the main regulatory authority supervising the electronic communications sector in Turkey. BTK describes itself as the institution that regulates and supervises the Turkish telecommunications sector and as Turkey’s first sectoral regulatory authority.
In addition, Turkey’s cybersecurity framework has been strengthened through Law No. 7545 on Cybersecurity, which was accepted on 12 March 2025 and published in the Official Gazette dated 19 March 2025. The law aims to identify and eliminate cyber threats, reduce the effects of cyber incidents, protect public and private sector actors against cyberattacks, strengthen national cybersecurity policies, and establish the Cybersecurity Board.
Why Cybersecurity Matters for Telecom Companies in Turkey
Telecom companies operate systems that are attractive targets for cybercriminals, hacktivists, state-linked threat actors, insider threats, ransomware groups, fraud networks, and malicious competitors. A successful cyberattack against a telecom operator may cause large-scale service interruption, data breaches, SIM swap fraud, unauthorized access to subscriber information, disruption of emergency services, manipulation of routing systems, DDoS attacks, malware propagation, financial loss, and loss of public trust.
Telecom companies hold large volumes of sensitive data. Subscriber identity information, phone numbers, IP addresses, location-related information, call detail records, traffic data, billing records, customer service records, payment information, device identifiers, SIM card information, authentication logs, and complaint records may all become targets in a cyber incident.
Cybersecurity failures in telecom networks may also affect other sectors. A DDoS attack against an internet service provider may disrupt banks, hospitals, e-commerce platforms, public portals, schools, logistics companies, and cloud services. A routing compromise may affect internet traffic integrity. A data breach may expose millions of users to identity theft or fraud. Therefore, telecom cybersecurity has a public-interest dimension.
Under Turkish law, this public-interest dimension is reflected in BTK’s supervision, sectoral network security obligations, USOM/SOME coordination, data breach notification duties, and the broader cybersecurity framework introduced by Law No. 7545.
Main Legal Framework for Telecom Cybersecurity in Turkey
Cybersecurity obligations for telecom companies in Turkey arise from several legal sources. The first is Law No. 5809 on Electronic Communications, which provides the general regulatory framework for electronic communications services, authorization, supervision, consumer protection, network security, and regulatory powers of BTK.
The second is BTK’s Network and Information Security Regulation in the Electronic Communications Sector. BTK states that operators are required to take measures against cyberattacks, establish a Corporate Cyber Incident Response Team and operate in coordination with the Sectoral Cyber Incident Response Team, and take necessary measures in coordination with USOM against DoS/DDoS attacks, malware propagation, and similar attacks.
The third is Law No. 7545 on Cybersecurity. This law created a broader national cybersecurity framework and applies to a wide range of actors operating or providing services in cyberspace. The Cybersecurity Presidency’s official announcement states that it was established under Presidential Decree No. 177 and Law No. 7545 to increase the cyber resilience of critical infrastructure systems and ensure digital security against cyber threats.
The fourth is Law No. 6698 on the Protection of Personal Data. Telecom companies are usually data controllers for subscriber data and must take all necessary technical and organizational measures to prevent unlawful processing, unlawful access, and ensure the protection of personal data.
The fifth source is BTK’s audit and supervisory powers. BTK may supervise telecom operators financially, technically, legally, and administratively, request information and documents, monitor compliance with license conditions and relevant legislation, and impose sanctions where operators fail to comply with regulations.
BTK Network and Information Security Obligations
BTK’s network and information security framework is one of the most direct sources of cybersecurity obligations for telecom operators. According to BTK, the Sectoral Cyber Incident Response Team was established within BTK on 10 September 2014 to ensure coordination in the electronic communications sector. Under the Network and Information Security Regulation in the Electronic Communications Sector, operators must take measures against cyberattacks, establish Corporate CSIRTs, and operate in coordination with the Sectoral CSIRT.
BTK also states that operators must take necessary measures in coordination with USOM against DoS/DDoS attacks, malware propagation, and similar cyberattacks. This obligation is especially important for internet service providers, mobile operators, fixed-line operators, infrastructure operators, and satellite communication providers because their networks may be used as both targets and vectors of attack.
The obligation to take measures should be understood broadly. It includes preventive, detective, responsive, and corrective controls. Telecom companies must not wait until a cyber incident occurs. They should design their networks, access controls, monitoring tools, incident response plans, vendor relationships, and operational procedures with cyber resilience in mind.
A telecom operator should be able to prove that it has adopted appropriate cybersecurity measures. In an audit, complaint, or incident investigation, merely claiming that “security measures exist” may not be sufficient. The company should maintain written policies, technical logs, incident records, test reports, risk assessments, access authorization records, and board-level decisions.
Corporate CSIRT/SOME Obligations
One of the key cybersecurity obligations for telecom companies in Turkey is the establishment and operation of a Corporate Cyber Incident Response Team, commonly referred to as Corporate CSIRT or Kurumsal SOME. BTK explains that Corporate CSIRTs have been established within operators designated under the Network and Information Security Regulation and the relevant BTK Board Decision, and that 24/7 accessible contact information and personnel information have been obtained.
A Corporate CSIRT is not merely a symbolic internal team. It should be an operational cybersecurity unit capable of identifying, assessing, escalating, responding to, and reporting cyber incidents. It should coordinate with BTK’s Sectoral CSIRT, USOM, internal IT teams, legal counsel, data protection teams, senior management, customer communication teams, and external cybersecurity providers.
A proper Corporate CSIRT should include clear roles and responsibilities. It should define who receives alerts, who classifies incidents, who contacts regulators, who manages technical containment, who preserves evidence, who informs affected customers, who communicates with management, and who prepares post-incident reports.
For telecom operators, CSIRT maturity is essential. A cyber incident affecting network availability or subscriber data may require immediate legal and technical action. Delayed response may worsen damage, increase regulatory exposure, and create additional liability.
DDoS, Malware and Network Protection Duties
BTK expressly refers to DoS/DDoS attacks, malware propagation, and similar cyberattacks in the context of operator obligations. Operators must take necessary measures in coordination with USOM against such threats.
For telecom companies, DDoS protection is a critical obligation because telecom networks are frequently targeted by volumetric attacks, application-layer attacks, reflection attacks, botnet traffic, DNS abuse, and attacks against customer-facing services. A DDoS attack may disrupt internet access, mobile applications, online customer portals, VoIP systems, corporate leased lines, DNS services, and hosted services.
BTK also refers to mechanisms such as signal processing control, user authentication, access controls in IP addresses, communication ports and application protocols, and cyberattack protection services upon request. These measures show that telecom cybersecurity obligations are not limited to internal office systems; they extend to core network infrastructure, routers, servers, access layers, application protocols, and customer-facing services.
A telecom operator should implement layered DDoS defense, malware detection, threat intelligence monitoring, anti-botnet controls, IP reputation systems, network segmentation, anomaly detection, traffic scrubbing, incident escalation, and customer communication procedures.
Cybersecurity Law No. 7545 and Telecom Companies
Law No. 7545 on Cybersecurity is especially important for telecom companies because electronic communications infrastructure may fall within the broader national cybersecurity and critical infrastructure framework. The law’s purpose includes identifying and eliminating cyber threats, reducing the effects of cyber incidents, protecting public and private actors against cyberattacks, strengthening national cybersecurity strategies, and establishing the Cybersecurity Board.
The official USOM announcement also shows the institutional transition toward the Cybersecurity Presidency. It states that CVE applications, cyber reporting processes, malicious link lists, security notifications, and technical content previously provided through USOM will continue through the Cybersecurity Presidency’s platform under the relevant legislation.
For telecom companies, this means that cybersecurity compliance should be monitored not only through BTK regulations but also through the developing national cybersecurity framework. Operators should follow decisions, guidance, technical standards, reporting procedures, and announcements issued by the Cybersecurity Presidency, USOM, BTK, and other competent authorities.
Law No. 7545 also strengthens the view that cybersecurity is a board-level governance issue. Telecom companies should not leave cybersecurity solely to IT teams. Legal, compliance, risk management, internal audit, procurement, operations, data protection, and senior management must work together.
Personal Data Security and Data Breach Notification
Telecom cybersecurity and personal data protection are closely connected. If a cyber incident results in unauthorized access to subscriber data, customer records, billing data, traffic data, location data, identity data, or IP logs, the incident may also constitute a personal data breach under Law No. 6698.
Under Article 12 of the Personal Data Protection Law, data controllers must take all necessary technical and organizational measures to prevent unlawful processing of personal data, prevent unlawful access to personal data, and ensure personal data protection. Data controllers must also conduct or have conducted necessary audits within their own organization.
The Personal Data Protection Authority explains that if processed personal data are obtained by others by unlawful means, the data controller must notify the data subject and notify the Board within the shortest time. The Board’s Decision No. 2019/10 interpreted this period as not later than 72 hours after becoming aware of the breach.
This is highly relevant for telecom companies. A cyber incident affecting subscriber databases, call center systems, billing platforms, customer portals, SIM activation systems, traffic logs, or dealer systems may trigger both cybersecurity incident response obligations and personal data breach notification obligations.
A telecom operator should therefore maintain an integrated incident response plan covering both technical containment and legal notification. The legal team and data protection team should be involved from the early stages of incident assessment.
Security of Subscriber Data, Traffic Data and Location Data
Telecom operators process high-risk data. Subscriber data may include identity information, addresses, phone numbers, payment information, invoices, customer service records, and contract data. Traffic data may include connection logs, IP allocation records, call metadata, session times, routing data, and usage records. Location data may reveal a user’s movements, habits, work location, home area, and social patterns.
Cybersecurity obligations must therefore be tailored to the sensitivity of telecom data. Security measures should be stronger for traffic data, location data, authentication systems, SIM swap processes, privileged administrator accounts, network management systems, and billing platforms.
Operators should implement role-based access control, multi-factor authentication, privileged access management, encryption, logging, anomaly detection, database monitoring, data loss prevention, secure backup, secure API management, and segregation of duties.
Dealer and call center systems are also major risk areas. Unauthorized SIM replacement, identity document misuse, disclosure of subscriber information, social engineering, and excessive access by sales personnel may create both cybersecurity and data protection liability.
Vendor, Cloud and Supply Chain Cybersecurity
Telecom operators usually rely on complex vendor ecosystems. Network equipment suppliers, software vendors, cloud providers, managed security service providers, billing system vendors, customer relationship management providers, call center vendors, dealer networks, subcontractors, data center operators, and maintenance contractors may all access sensitive systems.
Cybersecurity obligations extend to these relationships. A telecom company cannot avoid responsibility by outsourcing critical operations. Under personal data protection law, the data controller may remain jointly responsible with data processors for data security measures where personal data are processed on its behalf.
Therefore, telecom companies should conduct vendor risk assessments, impose contractual cybersecurity obligations, require incident notification clauses, define audit rights, control subcontracting, require encryption and access management, review cloud locations, ensure business continuity, and monitor third-party compliance.
Supply chain risk is particularly important in telecommunications because compromised equipment, insecure software updates, weak vendor credentials, or unmanaged remote access may create systemic vulnerabilities. Operators should maintain an inventory of critical vendors and require security-by-design principles in procurement.
Business Continuity and Service Availability
Telecom services have a strong continuity dimension. Network outages may affect emergency communication, public services, business operations, online education, digital banking, healthcare, and consumer rights. For this reason, cybersecurity programs must include business continuity and disaster recovery.
BTK’s audit page emphasizes that telecommunications services are public services by nature and that supervision becomes more important because network security and continuity are necessary for national security and public order.
A telecom company should prepare continuity plans for core network failures, DDoS attacks, ransomware incidents, data center outages, power failures, routing incidents, DNS compromise, submarine cable disruptions, satellite interruptions, cloud outages, and major vendor failures.
Continuity planning should include backup systems, redundancy, failover procedures, emergency communication channels, crisis management committees, customer notification templates, regulatory notification procedures, and post-incident review mechanisms.
BTK Audits and Cybersecurity Evidence
BTK may audit operators financially, technically, legally, and administratively, request information and documents, and impose sanctions for non-compliance. For telecom cybersecurity, this means that operators should be ready to demonstrate compliance with network and information security requirements.
Audit readiness requires documentation. Operators should maintain cybersecurity policies, risk assessments, incident response procedures, CSIRT records, training records, penetration test reports, vulnerability scan reports, DDoS protection reports, access logs, vendor security assessments, business continuity test records, backup reports, and evidence of coordination with competent authorities.
If a cyber incident occurs, the operator should preserve evidence carefully. Logs, system images, network traffic records, security alerts, user access records, firewall logs, endpoint detection records, e-mail headers, vulnerability evidence, and incident timelines may become critical in regulatory investigations, civil claims, criminal complaints, and insurance processes.
Administrative Sanctions and Legal Liability
Cybersecurity failures may lead to several types of legal liability. First, BTK may impose regulatory sanctions if the operator fails to comply with electronic communications legislation, authorization conditions, network security rules, or audit requests. BTK’s audit function includes monitoring compliance with license conditions, equipment standards, relevant legislation, and spectrum use, and sanctions may be imposed on operators that do not comply with regulations.
Second, the Personal Data Protection Authority may impose sanctions where a cybersecurity incident results in unlawful processing, unlawful access, insufficient data security, delayed breach notification, or failure to conduct necessary audits.
Third, affected subscribers may claim compensation if they suffer damages due to service interruption, identity theft, SIM swap fraud, data exposure, unauthorized account access, or operator negligence.
Fourth, corporate customers may bring contractual claims if the operator fails to provide agreed service levels, uptime, cybersecurity commitments, or incident notification obligations.
Fifth, in certain cases, cyber incidents may trigger criminal law issues, especially where unauthorized access, unlawful disclosure of personal data, fraud, malware activity, or intentional network sabotage is involved.
Practical Cybersecurity Compliance Checklist for Telecom Companies
A telecom company operating in Turkey should implement a structured cybersecurity compliance program. The following checklist may be used:
Classify all regulated telecom services and identify applicable BTK security obligations.
Establish or update a Corporate CSIRT/SOME structure.
Maintain 24/7 incident response contact information where required.
Coordinate with BTK Sectoral CSIRT, USOM, and the Cybersecurity Presidency where applicable.
Prepare a written cyber incident response plan.
Prepare a personal data breach notification procedure.
Create a DDoS response and mitigation plan.
Implement malware detection and anti-botnet controls.
Protect routers, servers, DNS infrastructure, network elements, customer portals, and billing systems.
Apply role-based access controls and privileged access management.
Use multi-factor authentication for sensitive systems.
Encrypt sensitive data at rest and in transit.
Maintain secure and tested backups.
Conduct vulnerability assessments and penetration tests.
Monitor logs and network anomalies.
Prepare vendor and supply chain cybersecurity controls.
Review cloud service providers and cross-border access risks.
Train technical, legal, customer service, dealer, and management teams.
Create crisis communication procedures.
Document all incidents, decisions, technical actions, and notifications.
Monitor BTK, USOM, Cybersecurity Presidency, and KVKK announcements.
Prepare for BTK and KVKK audits.
Cybersecurity Governance for Telecom Boards and Management
Cybersecurity should be treated as a board-level governance issue. Senior management should approve cybersecurity policies, allocate sufficient budget, review cyber risks periodically, receive incident reports, and ensure coordination between technical and legal teams.
A telecom company’s board should ask the following questions:
Do we have a functioning Corporate CSIRT?
Do we have a current cyber incident response plan?
Can we detect and respond to DDoS attacks quickly?
Do we know where subscriber data, traffic data and location data are stored?
Are our vendors contractually required to notify cyber incidents?
Can we meet the 72-hour KVKK breach notification expectation if personal data are compromised?
Have we tested our backup and disaster recovery systems?
Do we maintain evidence for BTK audits?
Have employees and dealers received cybersecurity training?
Do we have a crisis communication plan for major outages or data breaches?
These questions demonstrate that cybersecurity compliance is not only about technology. It is also about management responsibility, legal risk control, documentation, and organizational preparedness.
Foreign Telecom Companies and Cybersecurity Compliance in Turkey
Foreign telecom companies providing services in Turkey or targeting Turkish users must carefully evaluate Turkish cybersecurity obligations. A foreign company may be subject to Turkish rules if it operates local infrastructure, provides electronic communications services, processes subscriber data in Turkey, uses Turkish customer data, provides cloud communication tools, offers IoT connectivity, provides satellite internet, or works with Turkish telecom operators.
Foreign companies should not assume that cybersecurity compliance in their home country is sufficient. Turkish law may require additional measures, local coordination, data breach notification, sectoral reporting, local audit readiness, and compliance with BTK and Cybersecurity Presidency expectations.
Foreign investors should review local contracts, data processing agreements, cloud hosting arrangements, support access, remote administration tools, customer service systems, incident response procedures, and regulatory notification channels before launching services in Turkey.
Conclusion
Cybersecurity obligations for telecom companies in Turkey are comprehensive, technical, and legally significant. Telecom operators must comply with BTK network and information security rules, Corporate CSIRT/SOME obligations, USOM coordination expectations, Cybersecurity Law No. 7545, personal data protection obligations, breach notification rules, audit requirements, consumer protection principles, and service continuity responsibilities.
The most important point is that cybersecurity is not only an IT issue. For telecom companies, cybersecurity is a regulatory obligation, a consumer protection duty, a personal data protection requirement, a national infrastructure concern, and a corporate governance responsibility.
Companies that fail to implement adequate cybersecurity measures may face regulatory sanctions, data protection penalties, consumer claims, contractual disputes, service interruption losses, reputational damage, and operational disruption. Companies that build a strong cybersecurity compliance program, however, can reduce risk, protect subscribers, strengthen business continuity, and build trust in the Turkish telecommunications market.
As Turkey’s digital infrastructure continues to expand through fiber networks, mobile technologies, 5G, IoT, cloud communication, satellite internet, data centers, and digital public services, cybersecurity will remain one of the most important legal obligations for telecom companies operating in Turkey.
Frequently Asked Questions
What are the main cybersecurity obligations for telecom companies in Turkey?
Telecom companies must take measures against cyberattacks, establish appropriate incident response structures, coordinate with sectoral authorities where required, protect network infrastructure, secure subscriber data, respond to DDoS and malware threats, comply with BTK rules, and notify personal data breaches where applicable.
What is BTK’s role in telecom cybersecurity?
BTK supervises the electronic communications sector and has sector-specific network and information security responsibilities. It may audit operators, request information and documents, and impose sanctions for non-compliance.
What is Corporate CSIRT or Kurumsal SOME?
Corporate CSIRT, or Kurumsal SOME, is an internal cyber incident response team established by designated operators to detect, manage, report, and respond to cyber incidents in coordination with sectoral and national cybersecurity structures.
What is the importance of USOM for telecom companies?
USOM has historically provided cyber incident reporting processes, malicious link lists, security notifications, and technical content. Its functions are now connected with the Cybersecurity Presidency framework under the current cybersecurity legislation.
Do telecom companies need to notify personal data breaches?
Yes. If a cyber incident results in personal data being obtained by others unlawfully, the data controller must notify the Personal Data Protection Board and affected data subjects according to Turkish data protection rules. The Board interprets the notification period as not later than 72 hours after becoming aware of the breach.
Are DDoS protection measures legally important for telecom operators?
Yes. BTK expressly refers to operators’ obligation to take necessary measures in coordination with USOM against DoS/DDoS attacks, malware propagation, and similar cyberattacks.
Can cybersecurity failures lead to administrative sanctions?
Yes. Cybersecurity failures may trigger BTK sanctions, data protection penalties, consumer claims, contractual liability, and reputational damage, depending on the nature and consequences of the incident.
Should cybersecurity be managed only by the IT department?
No. Cybersecurity in the telecom sector should be managed jointly by IT, legal, compliance, risk management, data protection, customer communication, procurement, internal audit, and senior management teams.
No Responses