CYBERSECURITY ACT NO. 7545 AND THE TRANSFER OF COMMUNICATIONS INTERCEPTION POWERS From Critical Infrastructure Protection to Access Control: Expanded Competences under Law No. 7590, the Problem of Judicial Oversight and the Risk of Censorship Review Article Cybersecurity law • communications interception • access blocking • judicial oversight • freedom of expression ABSTRACT Cybersecurity Act No. 7545, published in Official Gazette No. 32846 of 19 March 2025, regulated cybersecurity through a dedicated statute for the first time in Türkiye and conferred extensive duties and powers on the Cybersecurity Directorate established by Presidential Decree No. 177. Law No. 7590, published in Official Gazette No. 33326 of 31 July 2026, added a second layer to that structure, transferring internet domain name management, internet infrastructure and communications detection and analysis functions from the Information and Communication Technologies Authority to the Directorate and empowering the Directorate to impose urgent measures without awaiting a judicial decision. This study examines both instruments in their technical and legal dimensions. It first sets out the distinct legal foundations of the cyber resilience, criminal interception and preventive access control regimes, and then discusses the problems arising from consolidating those three regimes within a single administrative body. The search and seizure power under Article 8 of the Act and the criminal provisions under Article 16 — particularly the paragraph on allegations of data breaches — are assessed in terms of the principle of legal certainty and chilling effect; the two-hour implementation and twenty-four-hour submission periods of the urgent measure mechanism are compared with the minimum safeguards developed in the European Court of Human Rights case law on secret surveillance. The study argues that although the cybersecurity rationale of the regulation is legitimate, the breadth of the powers combined with the deferral of judicial oversight structurally increases the risk of function creep and use as an instrument of censorship, and that this risk can be offset only by concrete safeguards such as time limits, notification duties, independent oversight and transparency reporting.
Keywords: cybersecurity law, Law No. 7545, Law No. 7590, Cybersecurity Directorate, communications detection and analysis, access blocking, urgent measures, judicial oversight, criminal judgeship of peace, freedom of expression, censorship, function creep, critical infrastructure, ECtHR, proportionality ABSTRACT Cybersecurity Act No. 7545, published in Official Gazette No. 32846 of 19 March 2025, regulated cybersecurity through a dedicated statute for the first time in Türkiye and conferred extensive powers upon the Cybersecurity Directorate established by Presidential Decree No. 177. Law No. 7590, published in Official Gazette No. 33326 of 31 July 2026, added a second layer to this structure by transferring internet domain name management, internet infrastructure administration and communications detection and analysis functions from the Information and Communication Technologies Authority to the Directorate, and by empowering the Directorate to impose urgent measures without awaiting a judicial decision. This study examines both instruments in their technical and legal dimensions. It first distinguishes the separate legal bases of cyber resilience, criminal interception and preventive access control regimes, then discusses the problems arising from consolidating all three within a single administrative body. The search and seizure power under Article 8 and the criminal provisions under Article 16 -- particularly the paragraph concerning allegations of data breaches -- are assessed in terms of legal certainty and chilling effect, while the two-hour implementation and twenty-four-hour submission periods of the urgent measure mechanism are compared against the minimum safeguards developed in the European Court of Human Rights case law on secret surveillance. The study argues that although the cybersecurity rationale is legitimate, the breadth of powers combined with deferred judicial review structurally increases the risk of function creep and use as an instrument of censorship, and that this risk can only be offset by concrete safeguards such as time limits, notification duties, independent oversight and transparency reporting. Keywords: cybersecurity law, Law No. 7545, Law No. 7590, Cybersecurity Directorate, communications interception, access blocking, urgent measures, judicial review, criminal judgeship of peace, freedom of expression, censorship, function creep, critical infrastructure, ECtHR, proportionality 1. Introduction States' efforts to strengthen their defensive capacity in cyberspace have produced new institutional structures and new powers in almost every country over the past decade. That attacks targeting critical infrastructure have reached a level capable of causing loss of life and major economic damage has made the need for regulation in this field indisputable. Yet because cybersecurity powers by their nature require access to network traffic, data flows and communications infrastructure, the same technical capacity can be both an instrument of defence and an instrument of surveillance, depending on the purpose for which it is used. That dual character constitutes the fundamental tension of cybersecurity law.
In Türkiye that tension has taken concrete form in two separate waves of regulation. The first wave is Cybersecurity Act No. 7545, published in Official Gazette No. 32846 of 19 March 2025. The Act regulated the protection of critical infrastructure, the establishment of cyber incident response teams and the standards and certification regime, and conferred extensive powers, including inspection, search and seizure, on the Cybersecurity Directorate established by Presidential Decree No. 177 of 8 January 2025.
The second wave is Law No. 7590 Amending Certain Laws and Decree-Laws, adopted by the Grand National Assembly of Türkiye on 24 July 2026 and published in Official Gazette No. 33326 of 31 July 2026. That Law transferred internet domain name management, internet infrastructure management and communications detection and analysis functions from the Information and Communication Technologies Authority (BTK) to the Cybersecurity Directorate; it further empowered the Directorate, on the request of security and intelligence bodies or of its own motion, to impose urgent measures without awaiting a judicial decision. Measures so imposed must be implemented by operators, access providers and data centres within two hours of notification; the measure is submitted to a criminal judgeship of peace within twenty-four hours and, if the judge does not decide within forty-eight hours, the measure lapses automatically.
That regulation rests on a technically comprehensible need: during an ongoing attack, closing off access to malicious infrastructure is a matter of minutes rather than hours, and classic judicial procedure is not suited to that speed. But because the same mechanism creates a means of interference with content and access operating without a judicial decision, it has been the subject of intense criticism in public debate and among professional bodies. In a joint declaration by the Alternative Informatics Association, the Internet Technologies Association, the Linux Users Association, the Free Software Association, the Pardus Users Association and the TMMOB Chambers of Computer Engineers and Electrical Engineers, the regulation was characterised directly as internet censorship (Alternative Informatics et al., 2026).
The aim of this study is not to repeat the parties' assertions but to analyse the text of the regulation against technical and legal criteria and to set out where the risk arises and by what safeguards it can be offset. No reference is made to any case, investigation or person; the aim is a technical and legal assessment of the legislation in force.
The remainder of the article is organised as follows. Section 2 distinguishes three different legal regimes — cyber resilience, criminal interception and preventive access control — and sets out the problem arising from their combination. Section 3 examines the architecture of Law No. 7545, Section 4 the institutional structure and state of implementation, and Section 5 the criminal provisions. Section 6 analyses the transfer effected by Law No. 7590 and the urgent measure mechanism; Section 7 addresses the problem of judicial oversight and Section 8 the European Court of Human Rights criteria. Section 9 discusses the risk of censorship together with the counter-arguments; Section 10 presents the comparative framework and Section 11 the consequences for digital forensics and expert practice. Section 12 contains recommendations and Section 13 the conclusion. 2. Conceptual Framework: Three Regimes Frequently Confused 2.1. Three Separate Legal Regimes Functions frequently grouped under a single heading in public debate belong legally to three separate regimes. Failure to draw that distinction blurs the arguments both of those defending and of those criticising the regulation.
The first regime is cyber resilience. The protection of critical infrastructure against attack, vulnerability and incident notification, the setting of security standards, inspection and certification fall within it. Its addressees are institutions and undertakings; its sanctions are essentially administrative. In the European Union that field is regulated by Directive (EU) 2022/2555 (NIS2). The second regime is criminal interception of communications. The interception and recording of communications and the evaluation of signal information in relation to a particular person, tied to suspicion of an offence and by judicial order, fall here. In Turkish law Article 135 of the Code of Criminal Procedure No. 5271 provides a detailed framework containing a catalogue of offences, time limits, a judicial order requirement and a subsequent duty of notification.
The third regime is preventive access control. The removal of content or blocking of access is applied independently of any suspicion of an offence and often in a way producing mass effect. In Turkish law Law No. 5651 regulates that field, and because it touches directly on freedom of expression it is the field in which constitutional review is most intense. 2.2. The Problem Arising from Combining the Regimes What the three regimes have in common is that all three rest on the same technical infrastructure — access to network traffic, control over routing and recording capacity. Legally, however, their bases of legitimacy, their addressees, their time limits and their oversight procedures are entirely different. A single institution commanding all three regimes offers an advantage in technical efficiency but legally creates the risk that levels of safeguard converge downwards towards the lowest.
That convergence works as follows: on grounds of administrative efficiency, the rapid procedure designed for the resilience regime comes increasingly to be applied to access control decisions as well. In the resilience regime speed is a legitimate necessity; in access control the same speed causes interference with freedom of expression to escape judicial oversight. That phenomenon, termed function creep in the literature, is a pattern regularly observed in the historical development of surveillance powers.
Figure 1. The institutional distribution of powers before and after Law No. 7590 As Figure 1 shows, before the transfer the three functions were located in three separate centres: resilience in the Cybersecurity Directorate, domain names and communications infrastructure in the BTK, and access blocking and search-and-seizure decisions in the judiciary. After the transfer the first two clusters have been gathered in a single administrative body, and the judiciary's position has shifted from being the body deciding in advance to the body approving afterwards. That is precisely where the structural change lies. 3. The Architecture of Law No. 7545 3.1. Purpose, Scope and Definitions Article 1 of the Act defines its purpose as the detection and elimination of threats to the elements constituting national power in cyberspace and the determination of principles for reducing the effects of cyber incidents. Article 2 sets the scope as public institutions and organisations, professional bodies and natural and legal persons operating in cyberspace, excluding intelligence activities. That exclusion is important: intelligence activities remain subject to the regime of the State Intelligence Services and National Intelligence Organisation Law No. 2937.
Among the definitions in Article 3, critical infrastructure is described as systems whose interruption could cause loss of life or major economic damage. But which sectors are to count as critical infrastructure is not enumerated in the text of the Act and is left to secondary legislation. That means the scope can be widened by administrative act and constitutes the first point of debate as regards legal certainty. 3.2. The Duties and Powers of the Directorate Article 5 of the Act lists the Directorate's duties as increasing the protection and resilience of critical infrastructure, establishing and supervising cyber incident response teams (SOME), preparing cybersecurity standards and carrying out testing and certification. Article 6 regulates its powers. The Directorate may arrange the installation of suitable software and hardware on information systems, provide on-site or remote response support to those affected by a cyber incident, request information, documents and data where necessary and retain them for up to two years, and collect and evaluate log records. The second paragraph of the article provides that personal data will be processed for specific, explicit and legitimate purposes and will be deleted, destroyed or anonymised when the reasons requiring access cease.
The maximum two-year retention period is a positive limit as regards the principle of data minimisation. By contrast, that the limits of the power to request information, documents and data where necessary are not narrowed in the article leaves it open to broad interpretation in practice. To what threshold the request is tied — a concrete cyber incident or a general risk assessment — is not clear from the text.
3.3. Obligations Article 7 of the Act imposes on those within its scope the obligations to provide the data and documents the Directorate requests in good time, to notify vulnerabilities and cyber incidents without delay, to procure from authorised cybersecurity specialists and to obtain certification approval. Those obligations have been in force since 19 March 2025; but implementation details such as the period within which and the form in which notification is to be made are left to secondary legislation. 3.4. Inspection, Search and Seizure Article 8 of the Act is technically the most contested provision. Its fourth paragraph confers on those assigned to inspect the power to examine data, documents and electronic infrastructure in the electronic environment, to take copies and to produce digital duplicates. The fifth paragraph regulates search and seizure. Under it, a search may be conducted for the purposes of national security, public order or the prevention of offences by judicial order or, where delay would be prejudicial, by the written instruction of the public prosecutor; copies may be taken and seizure effected in a manner not causing prolonged service interruption. An operation carried out without a judicial order is submitted for judicial approval within twenty-four hours and the judge decides within forty-eight hours. Whereas operations concerning data centre operators may be conducted only by judicial order, no judicial order is required for public institutions and organisations. That construction diverges from the general regime of criminal procedure in two respects. First, the ground for search is tied not to suspicion of an offence but to preventive concepts such as national security and public order; the scope of those concepts is far broader than the threshold of suspicion in criminal procedure. Second, the complete removal of judicial oversight for public institutions has the consequence that citizens' data held in public institutions is subject to the same regime. A citizen's health, tax or social security data becomes examinable without a judicial order simply because it is held by an institution. To whom the data belongs and where it is held are different matters; the provision's failure to observe that distinction is a legal rather than a technical deficiency.
4. Institutional Structure and the State of Implementation The Cybersecurity Directorate was established by Presidential Decree No. 177 of 8 January 2025. Law No. 7545 entered into force on 19 March 2025; the first Cybersecurity Director was appointed on 24 October 2025. By Presidential Decree No. 192 of 25 December 2025 the organisational structure was expanded and the staff complement raised from 135 to 204. In Official Gazette No. 33347 of 21 August 2026 the Directorate's announcement of the recruitment of 275 contract staff was published. That sequence shows that the institution is still in its establishment and staffing phase.
On the secondary legislation side, by contrast, the picture has not advanced at the same pace. The Act provided that all secondary legislation would enter into force by 19 March 2026. In an assessment made nine months after the Act entered into force, it was found that regulations on cyber incident notification and log management procedures, security policy and documentation standards, certification and authorisation procedures, technical criteria, an independent audit mechanism, the establishment and operation of SOMEs and the working procedures of the Cybersecurity Board had not yet been published, and that critical infrastructure sectors had not been officially determined (Forseti, 2025). That picture points to a striking asymmetry in the regulation's present state: the powers are in force while the content of the obligations remains uncertain. For obliged organisations that creates the problem of not being able to know in advance which conduct will count as a breach. In a regime providing for criminal and administrative fines, that uncertainty is not merely a practical difficulty but also a matter of debate as regards the principle of legality. A second consequence is the distance between institutional capacity and the breadth of the powers. Transferring simultaneously to a Directorate whose staff is expressed in three figures and which is only now completing its organisation — alongside critical infrastructure inspection — highly technical and high-volume functions such as domain name management, internet infrastructure and communications detection and analysis may in practice result in the power being exercised de facto by subordinate units and through routine procedures. The broader the power and the more limited the oversight capacity, the weaker the individualisation of decisions becomes.
5. The Criminal Provisions and the Problem of Legal Certainty 5.1. The Sanctions Provided Article 16 of the Act contains one of the heaviest catalogues of sanctions Turkish law has seen in the cybersecurity field. Table 1 summarises those sanctions. Table 1. Sanctions provided in Article 16 of Law No. 7545 Act Sanction Failure to provide requested information or documents 1-3 years' imprisonment + judicial fine of 500-1,500 days Operating without obtaining approval 2-4 years' imprisonment + judicial fine of 1,000-2,000 days Breach of the duty of confidentiality 4-8 years' imprisonment Producing or disseminating false content knowing there was no data breach 2-5 years' imprisonment Attacking elements constituting Türkiye's national cyber power 8-12 years' imprisonment Disseminating or selling data obtained through an attack 10-15 years' imprisonment Acting contrary to Article 12 3-5 years' imprisonment Abuse of office 1-3 years' imprisonment Failure to fulfil the responsibilities in Article 7 (administrative) 1,000,000 - 10,000,000 TL Failure to fulfil the responsibilities in Article 18 (administrative) 10,000,000 - 100,000,000 TL Note. Compiled by the author on the basis of Article 16 of Cybersecurity Act No. 7545. The table is a summary; the text of the article governs in practice.
5.2. The Data Breach Paragraph: Elements and Limits The most debated provision of the catalogue is the paragraph punishing with imprisonment of two to five years the production or dissemination of false content, knowing that there has been no cybersecurity-related data breach, with the aim of creating public panic or targeting institutions or persons. During the legislative process the scope of the provision was narrowed and the phrase 'data breach' changed to 'cybersecurity-related data breach'; but criticism continued that the amendment did not address the fundamental concerns.
The provision has three elements as an offence type:
• Material element: the production or dissemination of false content, • Mental element: knowledge that there has been no breach (direct intent), • Special intent: the aim of creating public panic or targeting institutions or persons. At the level of the text those elements limit the provision to a degree: a post made in good faith, in the belief that it is accurate, will not satisfy the definitional element. The problem arises not at the level of the text but at the level of application.
5.3. Chilling Effect The accuracy of an allegation of a data breach can often be established only after investigation. A security researcher or journalist may not know with certainty at the moment of posting whether the data set they hold derives from a genuine breach or from the recompilation of records already disclosed. That uncertainty turns the very possibility of an investigation being opened into a deterrent. That phenomenon, termed chilling effect in criminal law, operates not through conviction but through the risk of prosecution.
The concrete consequence of that effect is a turn towards sharing breach reports only with institutions rather than with the public, and the blocking of the responsible disclosure practice where the institution fails to respond. Criticisms of the provision have indeed been voiced by the Journalists' Union of Türkiye, the Freedom of Expression Association, the Media and Law Studies Association and international organisations in terms of journalistic activity and privacy. The balancing solution is not to remove the provision entirely but to provide an express ground of lawfulness for good faith security research and journalistic activity. In comparative law such safe harbour provisions do not weaken cybersecurity but strengthen it, because they encourage vulnerability reporting.
6. The Transfer Effected by Law No. 7590 6.1. Legislative Technique: The Omnibus Law As its title indicates, Law No. 7590 is an omnibus law amending several statutes. The same Law contains provisions on support for the tourism and manufacturing sectors, an increase in the minimum pension, taxation, social security, the public procurement system, transport and education. That a transfer of powers directly connected with fundamental rights and freedoms, such as communications infrastructure and communications detection and analysis, is regulated within a law of that scope is in itself a matter of criticism as regards legislative technique. The omnibus method makes it effectively impossible for the regulation to be debated separately and in depth on its own subject. How much a provision was debated in the plenary is not a direct criterion in any subsequent constitutional review; but it is decisive for the public's opportunity to be informed, for stakeholder views to be taken and for the regulation to mature. Regulating provisions affecting fundamental rights through dedicated statutes is a matter not of procedural economy but of democratic legitimacy.
6.2. The Powers Transferred By Article 21 of the Law the BTK's powers were transferred to the Cybersecurity Directorate. The scope of the transfer falls under three main headings:
• Internet domain name management. By Article 60/A added to Electronic Communications Law No. 5809, the power to determine strategy and policy on internet domain names and to regulate in that field was given to the Directorate, and the BTK's duties concerning domain names were removed.
• Internet infrastructure management. Powers concerning data centres and technical infrastructure were gathered within the Directorate.
• Communications detection and analysis. The detection and analysis function concerning electronic communications traffic was transferred to the Directorate.
In addition, references to the BTK in Law No. 5651 were changed to the Cybersecurity Directorate, and a transitional article added to Law No. 7545 regulated the transfer of personnel, assets and infrastructure from the BTK to the Directorate. The Directorate thereby also became the body implementing access blocking and content removal decisions under Law No. 5651. Although the transfer of domain name management appears at first sight to be a technical regulation, its consequences are significant. The body commanding the domain name system can determine whether a domain name resolves; and that is the fastest and widest-reaching technical method of access blocking. Gathering domain name management, communications infrastructure and the power to impose access measures in the same hands means tying every link of the technical chain to a single administrative will.
Table 2. The change in the distribution of powers effected by Law No. 7590 Function Before the transfer After the transfer Nature of oversight Critical infrastructure resilience, SOME, certification Cybersecurity Directorate Cybersecurity Directorate Administrative oversight Internet domain name ('.tr') management BTK Cybersecurity Directorate (Law 5809 Art. 60/A) Administrative regulation Internet infrastructure and data centres BTK Cybersecurity Directorate Administrative regulation Communications detection and analysis BTK Cybersecurity Directorate No detailed safeguard in the Law Access blocking / content removal BTK (on a judicial decision) Cybersecurity Directorate Subject to judicial decision Imposing urgent measures None (judicial decision required) Cybersecurity Directorate (of its own motion or on request) Subsequent judicial approval (24 + 48 hours) Search and seizure (Law 7545 Art. 8) Cybersecurity Directorate Cybersecurity Directorate Judicial order; not required for public institutions Note. Compiled by the author on the basis of the provisions of Laws Nos. 7545 and 7590 and related institutional announcements.
6.3. The Urgent Measure Mechanism At the centre of the regulation lies the urgent measure mechanism. On the request of security and intelligence bodies or of its own motion, the Directorate may impose measures without awaiting a judicial decision. The measure imposed is notified immediately to operators, access providers, data centres or the relevant content and hosting providers and must be implemented within two hours at the latest of notification. The measure is submitted to a criminal judgeship of peace within twenty-four hours; the judge decides within forty-eight hours. If no decision is given, the measure lapses automatically.
Figure 2. The operation of the urgent measure mechanism and the time periods Figure 2 makes visible the mechanism's critical feature: there is a twenty-four-hour interval between the implementation of the measure and the commencement of judicial oversight, and throughout that interval the interference is fully in effect. Adding the judge's decision period, the completion of judicial oversight may take up to seventy-two hours.
The rule that the measure lapses automatically is a positive safeguard within the design; it prevents the measure continuing where the judge remains silent. But given the nature of interferences in the internet environment, that safeguard offers limited protection. Content or a service being inaccessible for seventy-two hours is in many cases sufficient for the interference to achieve its purpose; for newsworthy content that period is enough for the content to lose its currency. Lifting the measure afterwards therefore does not undo retrospectively the effect it produced.
The two-hour implementation period must also be assessed technically. The period may be reasonable and even necessary in a genuine attack scenario. But the same period leaves the operator no opportunity to assess the lawfulness of the measure, obtain legal advice or object. The practical consequence for the operator is that there is no option but to implement the measure without question. That intermediaries can resist unlawful requests is an important structural safeguard in protecting freedom of expression; it may be said that this period effectively removes that safeguard.
7. The Problem of Judicial Oversight 7.1. The Difference Between Prior and Subsequent Oversight In interferences with fundamental rights and freedoms, the timing of judicial oversight is as important as its existence. Oversight exercised in advance is protective because it can prevent the interference occurring; oversight exercised afterwards can only prevent the interference continuing. In the field of freedom of expression that distinction is particularly decisive, because closing off access to content for a particular moment often produces a result similar to closing it off permanently.
The urgent measure mechanism adopts by definition the subsequent oversight model. Its rationale is speed, and that rationale is defensible for cyber incident response. The problem is that the circumstances in which the mechanism may be used are not narrowly defined. Had the mechanism been confined to stopping an ongoing cyber attack, a balance could have been struck between the rationale of speed and the safeguarding of rights. Regulating the power in general terms allows the same rapid procedure to be used for content-based interference as well.
7.2. Criticisms of the Criminal Judgeship of Peace Model The body to which the measure is submitted is the criminal judgeship of peace. That objections to those judgeships' decisions are examined by criminal judgeships of peace in turn — that is, a closed circuit of objection — has long been criticised in doctrine and in international reports. The essence of the criticism is that the objection body not being a different level of the judiciary weakens the unity of case law and effective oversight.
That structural criticism acquires additional importance for the oversight of the urgent measure mechanism. Within a forty-eight-hour decision period the judge is expected to assess the necessity and proportionality of a technically complex measure — for example the non-resolution of a domain name or the blocking of particular traffic. The Law contains no provision on the judge's access to technical expert support for that assessment. In practice that creates the risk of the oversight becoming a formal approval. 7.3. The Constitutional Court's Case Law on Law No. 5651 Turkish constitutional review has developed notable case law on interferences in the internet environment. By its judgment of 11 October 2023 (case no. E.2020/76, decision no. K.2023/172) the Constitutional Court annulled paragraphs one, three, five, eight, nine, ten and eleven of Article 9 of Law No. 5651 on violations of personality rights; because the annulled provisions made the application of the other paragraphs impossible, the whole article was annulled. The annulment took effect on 10 October 2024 (Constitutional Court, E.2020/76, K.2023/172). The reasoning of the judgment is directly instructive for the present debate. The Court concluded that a regulation providing for the removal of content or blocking of access on the basis of an allegation of violation of personality rights imposed a disproportionate restriction on freedom of expression and of the press. In other words, even a measure resting on a legitimate aim (the protection of personality rights) may be found unconstitutional if its procedural safeguards are inadequate.
That case law establishes the following criterion for the urgent measure mechanism: the legitimacy of the aim of the interference is not sufficient on its own; the scope, duration and individualisation of the interference and whether an effective remedy exists are also assessed. It should also be recalled that in earlier individual application decisions — including decisions on the wholesale blocking of social network platforms — the Constitutional Court has treated blocking with mass effect as a violation of freedom of expression. 8. An Assessment Against European Court of Human Rights Criteria 8.1. Minimum Safeguards in Secret Surveillance In its case law on the secret interception of communications, the European Court of Human Rights has determined the minimum safeguards domestic law must contain. Formulated in Weber and Saravia and developed in later judgments, those criteria include: determining the nature of the circumstances in which the measure may be applied, defining the categories of persons who may be covered, setting a limit on the maximum duration of the measure, regulating the procedure for examining, storing and destroying the data obtained, determining the safeguards applicable to transfer to third parties, and specifying the circumstances in which the data will be destroyed (Weber and Saravia, 2006).
In Roman Zakharov the Court accepted that a surveillance system may be examined even in the abstract, and that where the system does not contain adequate and effective safeguards against abuse a violation may be found even if the applicant cannot point to a concrete measure directed at them (Roman Zakharov, 2015). In Szabó and Vissy the Court stressed that broad powers granted on grounds of national security require sufficiently individualised suspicion and independent — preferably judicial — prior authorisation (Szabó and Vissy, 2016). In Big Brother Watch the Grand Chamber adopted an end-to-end safeguards approach for bulk interception regimes, requiring independent oversight and subsequent review at every stage of the process (Big Brother Watch, 2021). 8.2. Case Law on Access Blocking On the freedom of expression dimension the Court has set out its criteria in two key judgments concerning Türkiye. In Ahmet Yıldırım, blocking access to an entire hosting service because of a single item of content was held to violate Article 10 on the ground that it did not meet the criteria of foreseeability and proportionality (Ahmet Yıldırım, 2012). In Cengiz and Others the wholesale blocking of a video-sharing platform was assessed in the same way (Cengiz and Others, 2015).
The common criterion emerging from those judgments is the collective effect criterion: even where the target of the interference is particular content, that non-target content also becomes inaccessible as a necessary consequence of the technical method removes proportionality. Measures applied at domain name or infrastructure level are, by their technical nature, precisely apt to produce that result. The assessment in Figure 3 is based on the text of the Law and may change if safeguards are strengthened by secondary legislation. Three gaps stand out in the table: no limit is provided on the maximum duration of the measure, notification to the person concerned and an effective remedy are not regulated, and there is no duty of regular reporting to an independent oversight body. Those three elements are accepted in ECtHR case law as the core safeguards preventing abuse; the absence of all three renders the system fragile as regards abstract review. Figure 3. The position of the current regulation against the minimum safeguards in ECtHR case law (the author's assessment) 9. The Risk of Censorship: Its Source, Limits and Counter-Arguments 9.1. What Is the Source of the Risk?
The risk of a regulation turning into an instrument of censorship arises mostly not from the regulator's intent but from the design itself. In a state governed by the rule of law, a power is assessed not by the good faith of those who will exercise it but by the obstacles it would meet if abused. On that criterion, four structural elements increase the risk in the regulation examined.
• The subject-matter limit of the power is not narrowly drawn. Because it is not stated expressly in the text that urgent measures are confined to stopping ongoing cyber attacks, the same procedure can be used for content-based interference. • The technical chain is gathered in a single pair of hands. When domain name management, internet infrastructure, communications detection and the implementation of the measure are combined in the same administrative body, no intermediate point remains at which the interference could technically be halted.
• Judicial oversight is deferred. The twenty-four-hour submission and forty-eight-hour decision periods mean oversight is postponed until after the interference; that period is sufficient in many cases for the interference to achieve its purpose.
• There is no transparency obligation. Unless how many measures were applied, how many passed judicial approval and how many lapsed automatically is published regularly, the public cannot assess how the power is being used.
9.2. The Phenomenon of Function Creep The historical development of surveillance and access control powers shows that such powers rarely narrow; they generally come to be used in fields broader than the purpose for which they were first granted. Function creep occurs as a rule not through an open breach of the law but through broad interpretation of an existing power. The application over time to different categories of content of technical infrastructure established on grounds of counter-terrorism or combating child abuse is a pattern with many examples in comparative law. The distinctive element increasing the risk of function creep in the regulation examined is that the measure may also be imposed on the request of security and intelligence bodies. That is a channel allowing a rapid procedure established on cybersecurity grounds to be used for implementing requests with no direct connection to cybersecurity. By what criterion the request's connection with cybersecurity will be reviewed is not stated in the regulation. 9.3. Counter-Arguments: The Rationales Supporting the Regulation For the assessment to be balanced, the rationales supporting the regulation must also be taken seriously.
First, the necessity of speed is real. Blocking access to the source of a phishing infrastructure, a malware command-and-control server or an ongoing denial-of-service attack is ineffective unless done within hours. Classic judicial procedure is not designed for that speed even for cases in which delay would be prejudicial. Second, the mechanism is not unlimited. The measure must be submitted to a judge within twenty-four hours, and if the judge does not decide the measure lapses automatically. That is a design in which silence is not interpreted in the administration's favour but produces a result against the measure; while it may not be more safeguarded than every model found in comparative law, neither is it an unsupervised power.
Third, there is a technical rationale for institutional consolidation. That the detection, analysis and response stages of cyber incident response are distributed among different institutions causes coordination delay in real incidents. In attacks on critical infrastructure the cost of delay can extend to loss of life.
Fourth, Türkiye is in a region of high threat density. The volume of attacks on public institutions and critical infrastructure is at a level requiring regulatory intervention; in that respect the enactment of a cybersecurity law is in itself a positive development.
None of those rationales is invalid. But they all share the feature of relating to the resilience regime. The necessity of speed, the need for coordination and threat density justify responding to an ongoing attack. None of them justifies the same rapid procedure being usable over content and access without subject-matter limit. The problem is not the existence of the power but that its scope extends beyond the technical rationale.
9.4. Civil Society's Criticism The joint declaration of seven professional and civil society organisations found Article 21 particularly problematic and argued that the regulation targets the functioning of the internet environment, data flows and applications, and communication and freedom of expression on social networks. Two main criticisms stand out in the declaration: that the Directorate is given the power to apply measures without awaiting a judicial decision, and that the Directorate is equipped with powers of uncertain limits and scope (Alternative Informatics et al., 2026).
The first of those criticisms identifies an accepted feature of the design; the debate is whether it is necessary and proportionate. The second, resting on the principle of legal certainty, has a stronger foundation for constitutional review. Under Article 13 of the Constitution, fundamental rights and freedoms may be restricted only by law and the restriction must be proportionate; the criterion of legality requires not merely the formal existence of a law but that the rule be accessible, foreseeable and certain.
9.5. The Debate on Virtual Network Services Another matter frequently treated in public debate as part of the same regulation is the debate on regulating Virtual Private Network (VPN) services. Under the draft framework on the agenda, defining services transmitting internet traffic encrypted for privacy or security purposes as virtual network services and their providers as virtual network service providers, together with an obligation to maintain a representative in Türkiye, is being discussed. Two matters must be separated in assessing this. First, the regulation in question is at draft stage; it could not be confirmed that the text of Law No. 7590 in force contains such a provision. Second, there is the technical reality: virtual private network technologies are not used only to circumvent access restrictions; the security of critical functions such as corporate remote working, the transport of banking and health data and the remote management of industrial control systems rests directly on that technology. A regulation restricting encrypted tunnelling capacity generally would, far from increasing cybersecurity, weaken it. It is therefore a technical necessity that any such regulation be designed to target particular forms of use rather than the service itself. 10. A Comparative Framework: NIS2 and the Principle of Separation In the European Union, cybersecurity governance is regulated by Directive (EU) 2022/2555 (NIS2). The Directive distinguishes essential and important entities, makes risk management measures mandatory, provides staged deadlines for incident notification and introduces senior management responsibility together with high administrative fines.
Compared with the regulation in Türkiye, the most striking difference lies less in the level of sanctions than in institutional design. In the NIS2 regime, national cybersecurity authorities and incident response teams are equipped with coordination, guidance and oversight functions and do not carry powers of communications interception or content blocking. Those functions are left to separate legal regimes and separate bodies. The separation is a conscious choice preserved at the cost of administrative inefficiency; its rationale is to prevent the risk created by gathering the security function and the surveillance function in the same hands.
The design in Türkiye reflects a choice in the opposite direction, combining resilience, infrastructure management and communications detection and analysis in a single Directorate. That choice does not in itself constitute unlawfulness; but it makes it essential to provide additional safeguards offsetting the risk the combination creates. In comparative law those safeguards are constructed as an independent oversight commission, mandatory transparency reporting, subsequent notification to the person concerned and parliamentary oversight. None of those instruments appears in the regulation examined.
Table 3. A comparison of institutional design in cybersecurity governance Criterion NIS2 model (EU) Türkiye model (7545 + 7590) Subject of the regulation Resilience and incident management only Resilience + infrastructure management + communications detection and analysis Content/access interference None — left to a separate regime Yes — urgent measure mechanism Power of communications interception Separate legal regime and separate body Transferred to the same Directorate Judicial oversight Subject to the procedure of the relevant regime Approval after the measure (24 + 48 hours) Transparency reporting Provided for Not provided for Independent oversight body Provided for Not provided for Weight of sanctions Predominantly administrative fines Predominantly imprisonment + high administrative fines Note. Compiled by the author on the basis of Directive (EU) 2022/2555 (NIS2) and the provisions of Laws Nos. 7545 and 7590.
11. Consequences for Digital Forensics and Expert Practice One of the fields in which the regulation will be reflected in practice is judicial proceedings. This section addresses the principal consequences for the expert conducting a technical examination. 11.1. The Chain of Evidence and Data Obtained by Administrative Means Under Article 8 of Law No. 7545, copies and digital duplicates taken in the course of an inspection are obtained within the framework of an administrative act. Where that data is subsequently used as evidence in a criminal investigation, the lawfulness of the manner of its acquisition becomes a matter requiring separate assessment. The regime of search, copying and seizure in computers under Article 134 of the Code of Criminal Procedure and the power of administrative inspection have different levels of safeguard.
What is decisive for technical examination is whether the imaging and integrity verification procedure was recorded. The evidential value of a digital duplicate depends on documentation of the moment it was taken, the tool used, the hash values and the person responsible at each stage of the chain. The absence of detailed regulation requiring that procedure for copies taken in the course of administrative inspection will lay the ground for future objections to the reliability of the evidence.
11.2. Examining Urgent Measure Records In disputes concerning the application of urgent measures — for example claims for compensation for an operator's loss arising from implementation, or for a declaration that the measure was unlawful — technical examination will focus on the technical method by which the measure was implemented. A resolution block at domain name level, a routing interruption at IP level and filtering at content level produce different scope and side effects; the proportionality assessment is made according to that difference.
The minimum records to be taken as the basis of examination in such files are: • The exact timestamp at which the measure notification arrived and the moment it was implemented, • The technical method applied (DNS, IP, URL, protocol level) and its scope, • The measure's non-target effect: other services under the same server or domain name, • The date of submission to the judgeship, the date of the judge's decision and compliance with the time periods, • Where the measure is lifted, the time and integrity of the reversal operation. Interim orders by courts expressly requiring those records will ensure that the technical examination rests on records rather than assertions. Detailed determination of the record-keeping obligation in secondary legislation is in the interests of the administration, of obliged parties and of the judiciary alike.
12. Recommendations In the light of the assessments above, concrete recommendations that would reduce the risk of censorship without weakening the regulation's security function are offered below.
• Limiting the urgent measure by subject matter. It should be stated expressly in the text of the Law that the mechanism is confined to stopping ongoing or concretely imminent cyber attacks and cannot be used for content-based interference. • Introducing a maximum time limit. A maximum duration should be provided for measures that have passed judicial approval, and any extension made subject to a separate reasoned decision. • A duty of subsequent notification to the person concerned. At a stage that would not jeopardise the purpose of the measure, notification to those subject to it and indication of an effective remedy should be made mandatory; that is among the core safeguards of ECtHR case law. • Mandatory transparency reporting. The number of measures applied, the proportion passing judicial approval and lapsing automatically, the distribution of technical methods applied and the types of source of requests should be published at six-monthly intervals.
• Establishing an independent oversight body. An independent body should be provided for that continuously supervises the exercise of the power, contains technical expertise and reports to parliament.
• Technical expert support for the judgeships. A mechanism providing expert support to judgeships should be established so that technical assessment can be made within the forty-eight-hour decision period.
• Narrowing the exception for personal data in public institutions. The rule that no judicial order is required for searches in public institutions should be limited as regards personal data of third parties held by the institution. • A ground of lawfulness for good faith security research. An express safe harbour provision should be introduced for disclosures made within the scope of vulnerability reporting and responsible disclosure.
• Completing the secondary legislation without delay. The determination of critical infrastructure sectors, notification procedures, record-keeping standards and the independent oversight mechanism should be regulated as a matter of urgency.
• Regulating provisions affecting fundamental rights through dedicated statutes. Regulating provisions of that nature within omnibus laws should be avoided. 13. Conclusion Cybersecurity Act No. 7545 has given Türkiye's long-fragmented cybersecurity governance a dedicated statute and has met a genuine need as regards the protection of critical infrastructure. The enactment of the law, the creation of the institutional structure and the continuation of staffing are positive developments. The regulation in its present form nevertheless carries three structural problems. First, three regimes with different legal foundations — cyber resilience, communications interception and access control — are gathered in a single administrative body. While that combination provides technical efficiency, it creates the risk that levels of safeguard converge downwards towards the lowest. Second, in the urgent measure mechanism introduced by Law No. 7590 judicial oversight is deferred until after the interference; taking the two-hour implementation requirement together with the twenty-four-hour submission period, an interval arises in which the measure produces its full effect before oversight. Third, while the powers are in force, the secondary legislation determining the content of the obligations has not been completed.
The conclusion reached as regards the risk of censorship is this: the risk arises not from the regulator's intent but from the design itself. When the failure to draw a narrow subject-matter limit on the urgent measure, the gathering of the technical chain in a single pair of hands, the deferral of oversight and the absence of a transparency obligation are taken together, no mechanism remains that would legally prevent an instrument designed for cybersecurity being used for content control. That observation is not an allegation that the power has in fact been abused, but a finding that there is no structural obstacle to abuse; in a state governed by the rule of law that is the criterion of assessment. The rationales defending the regulation — the necessity of speed, the need for coordination and threat density — deserve to be taken seriously; but they all relate to the resilience regime and do not justify the rapid procedure being usable over content and access without subject-matter limit. The balance sought can be struck not by removing the power but by limiting its scope to the technical rationale and making its exercise auditable. The Constitutional Court's annulment of Article 9 of Law No. 5651 has shown that even a measure resting on a legitimate aim may be found unconstitutional if its procedural safeguards are inadequate. The absence of all three of the safeguards required in ECtHR case law — a maximum time limit, notification to the person concerned and independent oversight — renders the current regulation fragile as regards both constitutional and international review. Adding those safeguards by secondary legislation or by amendment would not weaken the regulation's security function; on the contrary, it would strengthen its legal foundation and its sustainability.
References Ahmet Yıldırım v. Türkiye, App. No. 3111/10, ECtHR (18 December 2012). Alternative Informatics Association, Internet Technologies Association, Linux Users Association, Free Software Association, Pardus Users Association, TMMOB Chamber of Computer Engineers and TMMOB Chamber of Electrical Engineers. (2026). The regulation granting unlimited powers to the Cybersecurity Directorate is internet censorship [Joint declaration]. https://www.linux.org.tr/2026/08/siberguvenlik-baskanligina-sinirsiz-yetki-veren-duzenleme-internet-sansurudur/ Constitutional Court. (2023). E.2020/76, K.2023/172, 11/10/2023 (annulment of Article 9 of Law No. 5651). Resmî Gazete (10 January 2024).
European Union. (2022). Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2). Official Journal of the European Union, L 333/80. http://data.europa.eu/eli/dir/2022/2555/oj Big Brother Watch and Others v. the United Kingdom [GC], App. Nos. 58170/13, 62322/14 and 24960/15, ECtHR (25 May 2021).
Cengiz and Others v. Türkiye, App. Nos. 48226/10 and 14027/11, ECtHR (1 December 2015). Presidency of the Republic. (2025a). Presidential Decree No. 177 on the Cybersecurity Directorate. Resmî Gazete (8 January 2025).
Presidency of the Republic. (2025b). Presidential Decree No. 192 (amendment on organisational structure). Resmî Gazete (25 December 2025).
Ekimdzhiev and Others v. Bulgaria, App. No. 70078/12, ECtHR (11 January 2022). Forseti Law Office. (2025). The Cybersecurity Act: where are we nine months on? Institutional structure, company obligations and overlooked risks. https://www.forseti.com.tr/genel/siber-guvenlik-kanunu/ Pekin Bayar Mizrahi. (2026a). A bill expanding the competences of the Cybersecurity Directorate has been submitted to the Grand National Assembly. https://pekin.com.tr Pekin Bayar Mizrahi. (2026b). Law No. 7590 Amending Certain Laws and Decree-Laws has entered into force. https://pekin.com.tr ProCompliance. (2026). The Cybersecurity Directorate's powers are expanding: what does the bill provide? https://www.procompliance.net Roman Zakharov v. Russia [GC], App. No. 47143/06, ECtHR (4 December 2015). Szabó and Vissy v. Hungary, App. No. 37138/14, ECtHR (12 January 2016). Vladimir Kharitonov v. Russia, App. No. 10795/14, ECtHR (23 June 2020). Weber and Saravia v. Germany (dec.), App. No. 54934/00, ECtHR (29 June 2006). State Intelligence Services and National Intelligence Organisation Law No. 2937. (1983). Resmî Gazete (3 November 1983, No. 18210).
Turkish Penal Code No. 5237. (2004). Resmî Gazete (12 October 2004, No. 25611). Code of Criminal Procedure No. 5271. (2004). Resmî Gazete (17 December 2004, No. 25673). Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications. (2007). Resmî Gazete (23 May 2007, No. 26530).
Electronic Communications Law No. 5809. (2008). Resmî Gazete (10 November 2008, No. 27050). Law No. 6698 on the Protection of Personal Data. (2016). Resmî Gazete (7 April 2016, No. 29677). Cybersecurity Act No. 7545. (2025). Resmî Gazete (19 March 2025, No. 32846). https://www.resmigazete.gov.tr/eskiler/2025/03/20250319-1.htm Law No. 7590 Amending Certain Laws and Decree-Laws. (2026). Resmî Gazete (31 July 2026, No. 33326).
