Practice Areas
IT and Internet Law
Where rights are violated over the internet, two separate processes run at the same time: the application for the removal of the content and the investigation into the criminal aspect of the act. Our firm conducts these two processes together and also prepares personal data and cyber security compliance work for companies.
Below you will find how the content removal and access blocking (erişim engelleme) process works, what the first steps are in cybercrime cases, what obligations companies have under the Personal Data Protection Law (KVKK), and answers to frequently asked questions.
How does the content removal and access blocking process work?
- Violation of personal rights (Turkish Civil Code (TMK) arts. 24–25). Since article 9 of Law No. 5651 was annulled by the Constitutional Court, applying to the criminal judgeship of peace (sulh ceza hâkimliği) is no longer possible for content targeting a person's honour and reputation. An action for the removal of the content is brought before the civil court of first instance (asliye hukuk mahkemesi); if keeping the content online until the end of the proceedings would cause serious harm, blocking of access or removal of the content is requested as an interim injunction (ihtiyati tedbir) (Code of Civil Procedure (HMK) art. 389).
- Violation of the privacy of private life (art. 9/A of Law No. 5651). For content that violates the privacy of private life, an application is made to the Cyber Security Directorate (Siber Güvenlik Başkanlığı); access providers implement the block within four hours at the latest. The applicant submits the request to the criminal judge of peace for approval within 24 hours; the judge decides within 48 hours, and if no decision is made, the block is lifted automatically. This route cannot be used for attacks on honour or reputation.
- Implementation of the decision. The block applies only to the link (URL) specified in the decision. A social network provider that fails to remove, or block access to, content found unlawful by a judge or court within 24 hours of being notified of the decision is directly liable for the resulting damage (Law No. 5651, additional art. 4).
- Application to the platform. A social network provider with more than one million daily accesses from Türkiye responds to applications for the removal of content with a reasoned answer within 48 hours (Law No. 5651, additional art. 4).
- Search engine results. The removal of links from search results may also be requested separately in respect of news archives or old content. For details, see our article The right to be forgotten: removal from Google results (in Turkish).
- Criminal investigation. Independently of the removal of the content, if the act constitutes an offence, a complaint is filed with the Chief Public Prosecutor's Office. For insult, the time limit for filing a complaint is six months from the date on which the act and the perpetrator became known and, in any event, two years from the date of the act (art. 73 of the Turkish Penal Code (TCK)).
- Compensation. A person whose personal rights have been infringed may also bring an action for pecuniary and non-pecuniary damages; this action is heard by the civil courts.
What are the first steps in cases of account takeover and online fraud?
In offences committed by means of information technology, digital traces can be deleted within a short time and money that has been transferred can quickly be moved on to other accounts. For this reason, the steps taken in the first hours after you notice the incident pave the way both for the investigation and for making good the loss.
- Preserve the evidence. Screenshots, link addresses (URLs), usernames, date and time information, correspondence and transaction receipts should be kept unaltered. If possible, the content should be recorded through a notary before it is deleted.
- Notify your bank immediately. The card or account should be blocked and unauthorised transactions should be disputed in writing. The timing of the notification is important in assessing the bank's liability.
- Contact the platform. The account recovery and abuse reporting mechanisms of the social media or email provider should be used.
- File a complaint. In the complaint petition to be submitted to the Chief Public Prosecutor's Office, you should request that the IP records, the subscriber information and the movements on the accounts to which the money was transferred be identified.
- Consider measures against assets. Measures such as seizure or precautionary attachment may come into consideration in respect of the accounts to which the money was transferred. For the time limits in precautionary attachment, see our article Precautionary attachment: conditions and strict time limits (in Turkish).
Where bank or credit card details have been used without consent, whether the bank took the necessary security measures is also examined. Depending on the amount in dispute, this examination may take place before a consumer arbitration committee (tüketici hakem heyeti) or a consumer court.
How is KVKK compliance structured for companies?
The Personal Data Protection Law No. 6698 imposes obligations on every natural and legal person that processes personal data. Compliance work is not a one-off exercise in preparing documents; it begins with mapping the flow of data within the company and is updated as business processes change.
Core obligations
- Duty to inform. When data is collected, the data subject is informed of the purpose for which and the legal basis on which the data is processed (art. 10).
- Legal basis. For each processing activity, one of the processing conditions laid down in the Law is identified; explicit consent is obtained only where no other legal basis exists (art. 5-6).
- Data security. Technical and administrative measures are taken to prevent the unlawful processing of, and unlawful access to, data (art. 12).
- Data subject applications. Requests from data subjects are concluded within thirty days at the latest (art. 13).
- VERBİS registration. Data controllers falling within the scope determined by the Law and by decisions of the Personal Data Protection Board register with the Data Controllers' Registry (art. 16).
- Transfers abroad. Since 1 June 2024, transfers abroad have been based primarily on an adequacy decision and, where there is no adequacy decision, on appropriate safeguards such as a standard contract or binding corporate rules. A standard contract is notified to the Authority within five business days of its signature (art. 9).
When a data breach occurs
Where personal data being processed is obtained by others through unlawful means, the data controller notifies the data subject and the Personal Data Protection Board of the situation as soon as possible (art. 12/5). The Board has decided that this notification must be made within seventy-two hours at the latest of the breach becoming known.
The data subject's route of complaint
The data subject first applies to the data controller. If the application is rejected, the response given is found insufficient or no response is given in time, a complaint may be filed with the Board within thirty days of the date on which the response became known and, in any event, within sixty days of the date of the application (art. 14).
What does the Cyber Security Law mean for companies?
The Cyber Security Law No. 7545, which entered into force on 19 March 2025, has introduced new obligations for public institutions and for natural and legal persons operating in cyberspace. These include complying with the policies and standards set by the Cyber Security Presidency (Siber Güvenlik Başkanlığı), reporting cyber incidents and security vulnerabilities, and submitting requested information and documents without delay. For breaches of these obligations, the Law also provides for administrative fines and for offences punishable by imprisonment.
It is particularly important for companies that manufacture in the organised industrial zones in Gebze, Dilovası and Sakarya and whose supply chains depend on digital systems to address KVKK compliance and their cyber security obligations within a single internal policy framework, and to put their incident response and notification procedures in writing in advance.
What work do we carry out?
- Preparing actions for the protection of personal rights with requests for interim injunctions, and access-blocking applications on grounds of privacy, for content on social media and websites
- Following up applications before the Cyber Security Directorate and social network providers
- Drafting complaint petitions and following the investigation in cases of insult, false accusation and threats committed via the internet
- Acting as the victim's representative in files concerning account takeover, phishing and aggravated fraud
- Preparing personal data compliance documents such as privacy notices, explicit consent forms, data inventories and retention and destruction policies
- Following up data breach notifications and complaints filed with the Personal Data Protection Board
- Filing applications for the removal of links from search engine results (right to be forgotten)
- Drafting and reviewing software licence, service level and confidentiality agreements
Types of cases we handle
- Offences against information systems: unlawful access to a system, blocking or disrupting a system, deleting or altering data (TCK art. 243-244)
- Offences relating to means of payment: misuse of bank or credit cards, possession of prohibited devices and programs (TCK art. 245, 245/A)
- Fraud committed by using an information system as a tool: phishing, fake website and fake investment platform files (TCK art. 158/1-f)
- Violations of personal rights committed via the internet: insult, false accusation, threats, violation of the privacy of private life (TCK art. 125, 267, 106, 134)
- Violations relating to personal data: unlawfully giving or obtaining data, data breach notifications, complaints to the Board (TCK art. 135-136; Law No. 6698)
- Digital commercial disputes: domain name disputes, receivables arising from software and licence agreements, e-commerce disputes. For ownership of rights in software, see our article Employee inventions and software copyright disputes (in Turkish).
For the criminal-proceedings aspect of cybercrime, you may also wish to look at our Criminal Law page, and for software and trademark rights at our Intellectual Property Law page.
Before which authorities are IT disputes handled on Istanbul's Anatolian side, in Kocaeli and in Sakarya?
In IT law, the process does not take place before a single authority; content removal, criminal investigations and administrative complaints are directed to different institutions. The competent venue is, as a rule, determined by the victim's domicile or by the place where the act was committed.
Istanbul's Anatolian (Asian) side
Actions for the protection of personal rights and requests for interim injunctions are heard by the civil courts of first instance at the Istanbul Anatolian Courthouse and the Istanbul Courthouse; approval of privacy-related blocks is sought from the criminal judgeships of peace, and complaints are filed with the Chief Public Prosecutor's Offices. Applications to the Personal Data Protection Authority and the Cyber Security Directorate, by contrast, can be submitted regardless of domicile.
Kocaeli and Sakarya
The civil courts of first instance, the criminal judgeships of peace and the Chief Public Prosecutor's Offices at the Kocaeli, Gebze and Sakarya courthouses are competent for actions and applications in these regions. For companies operating in the organised industrial zones in Gebze, Dilovası and Sakarya, KVKK and cyber security compliance work is prepared through on-site meetings tailored to the company's own operations.
Related practice areas
- Criminal Law: the criminal proceedings side of cybercrime, from the complaint to the trial
- Intellectual Property Law: rights in software, copyright and trademark disputes
- Constitutional Court and ECtHR Applications: freedom of expression, content removal and access-blocking decisions
To send us information about a content removal, cybercrime or KVKK compliance matter of yours on Istanbul's Anatolian side, in Kocaeli or in Sakarya, you can use our contact page or make an appointment at our office in Kadıköy.
The information on this page is general in nature and does not replace a legal opinion on a specific dispute.
Frequently Asked Questions
An application can first be made to the platform; the social network provider gives a reasoned answer within 48 hours (Law No. 5651, additional art. 4). If the content is not removed, an action is brought before the civil court of first instance and blocking of access to the content until the end of the proceedings is requested as an interim injunction (TMK arts. 24–25; HMK art. 389). If the content violates the privacy of private life, an application to the Cyber Security Directorate is also available (Law No. 5651, art. 9/A). Recording the content through a notary or an electronic determination before applying secures the evidence in case the content is later deleted.
A block imposed on grounds of privacy is implemented within four hours at the latest; the request is submitted to the criminal judge of peace for approval within 24 hours and the judge decides within 48 hours (Law No. 5651, art. 9/A). A social network provider that does not remove content found unlawful by a judge or court within 24 hours of being notified of the decision is liable for the resulting damage. Implementation is limited to the links specified in the decision; if the same content has been republished at other addresses, a separate request must be made for each.
First, an attempt is made to regain access via the email address and telephone number linked to the account, and the platform's own reporting channel is used. A complaint is then filed with the Chief Public Prosecutor's Office; records showing that the account belongs to you, the notification emails relating to the moment of the takeover and, if available, the content of messages are attached to the petition. If messages have been sent to third parties from the account, this is also stated separately.
As soon as the transaction is noticed, the bank is notified in writing and the transaction records are requested. On the same day, a complaint is filed with the Chief Public Prosecutor's Office and a request is made for the accounts to which the money was transferred to be blocked; applying early is decisive in stopping the money before it leaves the account. Where the bank's fault is in dispute, recourse may also be had to the consumer arbitration committee or the consumer court.
Compliance work is generally carried out through a data inventory, privacy notices, explicit consent forms, a personal data retention and destruction policy, the appointment of a contact person and, where required, VERBİS registration. Employee, customer and supplier data are dealt with separately; if data is transferred abroad, the conditions for the transfer are assessed separately.
The data controller notifies the Personal Data Protection Board within seventy-two hours at the latest of the date on which it learned of the breach. The persons affected by the breach are also informed within the shortest reasonable time. Failure to notify in time may result in an administrative fine.
Under the right to be forgotten, you may request the removal from the results of links that appear in searches made with your first name and surname. The request is first sent to the search engine; if it is rejected or left unanswered, a complaint may be filed with the Personal Data Protection Board. The assessment takes into account, together, how current the information is, the public interest and whether the person has taken on a public role.
Insult is, as a rule, an offence prosecuted only upon complaint, and the time limit for filing a complaint is six months from the date on which the act and the perpetrator became known and, in any event, two years from the date of the act (TCK art. 73). Missing this time limit brings criminal prosecution to an end; by contrast, a request for the removal of the content and an action for compensation are subject to separate time limits and procedures.
The Cyber Security Law No. 7545, which entered into force on 19 March 2025, has imposed on natural and legal persons operating in cyberspace obligations to comply with the policies and standards set by the Cyber Security Presidency, to report cyber incidents and security vulnerabilities, and to submit requested information and documents. Administrative fines and offences punishable by imprisonment have also been laid down for breaches of these obligations.