Information Technology Law

Information technology law examines the legal relationships surrounding data, software, networks, electronic transactions, cybersecurity, and digital evidence. A single technical system may simultaneously implicate data protection, contract law, copyright, cybercrime, consumer law, and cybersecurity duties; the applicable rule depends on the actor's role, the type of data, the purpose, and the specific operation.

IT-law rules change through legislation, regulatory decisions, and constitutional or high-court review. Engineering and legal analysis should therefore use the consolidated text in force on the date of the operation. This material is educational rather than legal advice; concrete disputes require a current-law review.

1. Method: characterize the operation before selecting the rule

The fact that a system is an information system does not determine the applicable statute. The same API request may be personal-data processing, performance of a contract, generation of evidence, reproduction of a copyrighted work, or part of a cybersecurity incident.

A reliable analysis asks:

• What data or digital asset is involved?
• Who performs the operation and in what legal role?
• What is the purpose and legal basis?
• Where does the data come from, where does it go, and how long is it retained?
• Are cloud, SaaS, CDN, analytics, telemetry, or support providers involved?
• Is copyrighted, licensed, patented, or confidential material involved?
• Does the event create criminal-law or cybersecurity obligations?
• Which logs, signatures, images, or records could later be relevant as evidence?

2. Current legislative map

There is no single Turkish "IT Law Act." Relevant fields include:

• Personal Data Protection Law No. 6698 (KVKK),
• Cybersecurity Law No. 7545,
• Internet Law No. 5651,
• cybercrime and personal-data offences in the Turkish Criminal Code No. 5237,
• Law No. 5846 on Intellectual and Artistic Works (FSEK),
• Industrial Property Law No. 6769,
• Law No. 5147 on Protection of Integrated Circuit Topographies,
• Electronic Signature Law No. 5070,
• Electronic Communications Law No. 5809,
• E-Commerce Law No. 6563,
• Consumer Protection Law No. 6502 and the Distance Contracts Regulation,
• Law No. 6493 on payment services and electronic money,
• electronic-document provisions of Civil Procedure Law No. 6100,
• digital search, copying, and seizure provisions of Criminal Procedure Law No. 5271.

Constitutional Court judgments, Data Protection Board decisions, BTK rules, Ministry of Trade rules, and sector-specific regulation must also be considered.

3. Copyright begins with the distinction between idea and expression

FSEK protects computer programs within the literary/scientific works category. Copyright is directed at protected expression rather than an abstract idea as such. The general concept of a queue, the abstract logic of an algorithm, a mathematical method, or the principles underlying a program element are not identical to a particular source-code implementation, explanation, diagram, or other original expression.

This distinction matters in software engineering. Learning that a problem can be solved with a ring buffer or Dijkstra's algorithm is different from copying another developer's implementation, comments, documentation, test data, or distinctive structure.

The fact that ideas are not protected does not authorize copying protected expression. Conversely, independently implementing the same function with independently written code does not become copyright infringement merely because the functionality is similar.

4. Potentially protected software elements

Depending on the facts, legally relevant software elements may include:

• source code,
• object/executable code,
• preparatory design material capable of leading to a program,
• original documentation,
• original visual or audiovisual elements,
• original selection or arrangement in a database,
• independently protectable visual aspects of an interface.

API names, protocol-required expressions, pure functionality, mathematical formulae, and technically necessary interoperability elements require a different analysis from freely chosen creative source-code expression.

5. Source code, object code, and preparatory design

Source code is human-readable program expression; object or executable code is a translated representation used in the execution chain. Copyright analysis is not limited to a .cs, .java, or .cpp file.

Preparatory design is not every project idea. For copyright purposes, the relevant question is whether the concrete preparatory material has reached a form capable of leading to a computer program rather than remaining an abstract proposal.

6. Author, right holder, and employer are distinct concepts

The natural person or persons who create a work are the starting point for authorship. For a computer program, the persons who write the source code are significant to that analysis. The authority to exercise economic rights may nevertheless lie elsewhere because of employment, contract, or statute.

Under FSEK Article 18, economic rights in works created by employees in the course of their duties may, unless otherwise agreed or implied by the nature of the work, be exercised by the employer. This should not be simplified into "the company is automatically the author."

Paying a contractor does not by itself transfer every economic right. FSEK Article 52 requires agreements and dispositions concerning economic rights to be in writing and the transferred rights to be specified separately.

7. Moral and economic rights

FSEK distinguishes moral and economic rights. Software projects commonly implicate reproduction, adaptation, distribution, and communication rights. Moral rights involve the relationship between the author and the work, including attribution and integrity-related interests.

Software has special statutory limitations and exceptions because maintenance, error correction, execution, and interoperability create needs that do not map perfectly to a general literary-work model.

8. Protection does not begin with registration

Copyright protection is not created by mandatory registration. The Ministry of Culture and Tourism's voluntary registration mechanism is declaratory and can help establish evidence of authorship; it does not create the right.

Git history, signed release tags, CI artifacts, trusted timestamps, notarial records, and internal change-management records may also support provenance. None automatically resolves all ownership questions.

The general protection period is the author's life plus seventy years, subject to the detailed statutory rules for particular cases.

9. Software licence: ownership and permission are different

Acquiring a software copy does not transfer all economic rights. A licence defines authorized forms of use.

A licence review should distinguish execution scope, copying, backup, modification, derivative works, redistribution, source access, sublicensing, commercial use, attribution/notice obligations, warranties, and patent provisions.

"Free of charge" is not the same as "open source." Open-source software remains copyrighted; permissions are granted under licence conditions.

10. Open-source compliance

MIT, BSD, Apache-2.0, GPL, LGPL, MPL, and other licences impose different conditions. Availability through a package manager does not mean unrestricted redistribution.

A production inventory should record component, version, direct/transitive status, licence, provenance URL, local modifications, distribution model, required copyright/NOTICE material, copyleft implications, and relevant patent terms.

An SBOM is useful evidence and inventory, but it is not itself a legal conclusion about licence compliance.

11. Lawfully acquired programs, backup, and error correction

FSEK Article 38 contains software-specific limitations and exceptions. A lawful acquirer may have defined rights connected with intended use, error correction, necessary backup, and observation or study of program operation.

Those rules do not mean that purchasing a program gives unrestricted source-code or redistribution rights. Normal use, adaptation, redistribution, and creation of a competing product must be distinguished.

12. Reverse engineering and interoperability

Reverse engineering is neither absolutely prohibited nor universally free. FSEK Article 38 provides a conditional space for decompilation when needed to obtain information necessary for interoperability of an independently created program.

The engineering distinction is between learning necessary functional/interoperability information and reproducing the protected expression of another program.

A clean-room process can separate the team that observes and documents lawful interface behavior from the team that independently implements the compatible system. This does not guarantee legality, but it can strengthen evidence of independent development.

13. Algorithms, APIs, and technical methods

The abstract algorithmic idea is not the classic object of copyright protection. A particular explanation, source-code implementation, diagram, or other original expression may be protected.

Implementing the normative requirements of an RFC or technical standard is different from copying its explanatory prose. A robust technical note reads the primary standard and explains the requirement independently, citing the relevant section instead of republishing long passages.

14. Plagiarism is not the same as copyright infringement

Plagiarism is an academic and professional ethics concept: presenting another person's original ideas, methods, data, or works as one's own without proper scholarly attribution. Copyright infringement is a separate legal analysis involving statutory exclusive rights and exceptions.

Four cases should be distinguished:

1. Copying protected text without permission while citing the source: attribution does not necessarily remove the copyright problem.
2. Presenting public-domain or permissively licensed material as one's own without attribution: there may be no copyright infringement, but plagiarism may remain.
3. Re-expressing an original idea while omitting scholarly attribution where attribution is expected: ethical plagiarism can exist without verbatim copying.
4. Independently implementing a known algorithm while citing the scientific source: depending on the facts, this may be both ethically and legally appropriate.

Citation does not substitute for a licence; a licence does not eliminate scholarly attribution obligations where attribution is ethically required.

15. Quotation and responsible citation

FSEK Article 35 regulates quotation under defined conditions. A quotation must be recognizable as such, proportionate to the legitimate purpose, and appropriately sourced in scientific works.

A bibliography entry does not legalize unlimited copying. Replacing a few words in a paragraph is not genuine paraphrasing.

A safer workflow is to extract the concept, close the source, rebuild the explanation using an independent structure, cite original claims/methods/data, and use verbatim quotation only when the wording itself is necessary.

Figures, tables, code, screenshots, and datasets must be assessed separately; a text citation is not automatically permission to reproduce them.

16. Code plagiarism and technical similarity

Similarity between code fragments is not by itself proof of plagiarism or infringement. Language syntax, framework requirements, standard API calls, and short idioms naturally converge.

More distinctive similarities can be more probative: unusual decomposition, comments, variable names, error messages, test data, free implementation choices, and identical defects.

A useful provenance record includes source or independent-development evidence, licence and version, commit history, third-party snippet URLs, review records, similarity-scan results, and design notes.

Code from a blog, Stack Overflow, a public repository, or a generative model is not automatically ownerless.

17. Material produced with generative AI: cautious treatment

Bill No. 2/3634 proposing amendments to FSEK for AI-era copyright issues remains pending in committee and is not enacted law.

The existing framework therefore remains the legal starting point. Whether a particular AI-assisted output qualifies for copyright protection, who may hold rights, and whether its use infringes earlier works depend on the applicable general rules and the facts, including human contribution and the nature of the output.

From an academic-integrity perspective, AI assistance does not remove verification or citation duties. A model-generated citation must be verified. Model output should not be used to disguise copied expression through automatic paraphrasing.

18. Databases: originality and investment are separate

Database protection may involve two different logics. Original selection or arrangement may qualify as a compilation work. FSEK Additional Article 8 also provides a sui generis framework related to substantial investment in obtaining, verifying, or presenting database contents.

This does not create ownership over every individual fact in the database. Personal-data law, contracts, trade secrets, unfair competition, and access-control rules may apply simultaneously.

Public accessibility is therefore not a sufficient legal test for web scraping.

19. Patents and software

Industrial Property Law No. 6769 Article 82 lists computer programs "as such" among subject matter not regarded as inventions. This should not be turned into the categorical statement that any invention involving software is unpatentable. The technical character and contribution of the claimed invention must be examined.

Copyright protects expression; a patent, when statutory requirements are met, protects a technical invention. Software products may also involve trademarks, designs, trade secrets, contracts, and database rights.

20. Integrated circuit topographies

Integrated circuit topographies are governed separately by Law No. 5147 and related TÜRKPATENT rules.

HDL source, physical layout, patentable technical features, and confidential manufacturing information should not be collapsed into a single intellectual-property category.

21. Personal data is relational, not merely a field name

Under KVKK, personal data are information relating to an identified or identifiable natural person. Device identifiers, activity logs, location, biometric templates, voice, and security telemetry can be personal data depending on context.

The absence of a name field does not place a system outside KVKK.

Anonymization is different from pseudonymization. If a person can reasonably be re-identified through a mapping key or available auxiliary data, the dataset may still be personal data.

22. Legal basis under KVKK: consent is only one option

KVKK Article 5 enumerates legal conditions for processing. Explicit consent is only one. Statutory obligation, contract necessity, legal obligation, establishment/exercise/protection of a right, and legitimate interests subject to fundamental-right safeguards are among the other conditions.

When another legal basis applies, obtaining unnecessary consent does not strengthen compliance and can mislead users.

A useful engineering inventory maps:

data -> purpose -> legal basis -> recipient -> retention -> security control

23. Special categories after the 2024 amendment

Law No. 7499 materially amended KVKK Article 6, effective 1 June 2024. Older notes based on the earlier health/sexual-life split do not fully describe the current regime.

For special-category data, identify the statutory category, the current Article 6 processing condition, and the additional safeguards required by the Board.

Biometric authentication should be assessed for necessity, proportionality, alternatives, lifecycle, and the irreversible harm that can follow a biometric compromise.

24. Privacy notice and explicit consent are separate

The duty to inform applies independently of whether processing relies on consent. Explicit consent is relevant only where consent is the selected legal basis.

The Data Protection Board's Principle Decision No. 2026/347 of 18 February 2026 emphasizes that privacy notices and explicit-consent texts should be separate and that notices must be clear, accurate, concise, and specific about purpose and legal basis.

A single UI checkbox that mixes notice acknowledgement with multiple unrelated consents is therefore risky. Consent state should be versioned and withdrawal should have real operational effect.

25. Data security and breach handling

KVKK Article 12 requires the controller to take necessary technical and administrative measures to prevent unlawful processing/access and to safeguard personal data.

Controls can include least privilege, strong authentication, encryption and key management, secure development, tamper-resistant logging, tested backup/restore, vulnerability management, data classification, incident response, and supplier controls.

An incident record should preserve scope, affected data, access time, indicators of exfiltration, containment measures, and the basis for notification decisions.

26. Cross-border transfers after 2024

KVKK Article 9 was redesigned in 2024. Cross-border transfers should no longer be described using the old consent-plus-safe-country/undertaking model.

The current structure uses adequacy decisions, appropriate safeguards where adequacy is absent, and limited derogations for occasional transfers where neither is available.

Standard contractual clauses and binding corporate rules are recognized safeguard mechanisms. Standard contracts must be notified to the Authority within five business days after signing.

A Turkish server does not automatically mean there is no cross-border transfer. Remote foreign support, SaaS telemetry, crash reporting, CDN processing, backups, and subprocessors must be included in the data-flow map.

27. Retention, deletion, and anonymization

Storage is not justified merely because it is technically cheap. Personal data should be retained only for the necessary purpose period, subject to applicable statutory retention and dispute/legal-hold requirements.

A retention rule should define trigger, mandatory period, hold logic, deletion/anonymization method, and backup behavior.

Soft delete is not necessarily legal deletion if the same personal data remain queryable in backups, indexes, or replicas.

28. Cybersecurity Law No. 7545

Cybersecurity Law No. 7545 was published on 19 March 2025. It has a broad scope covering actors active or providing services in cyberspace and establishes the Presidency of Cybersecurity's regulatory, coordination, and audit powers.

Article 7 provides responsibilities for persons and entities providing services, collecting data, processing data, or conducting similar activities through information systems. These include providing requested information and technical material, taking required cybersecurity measures, and reporting identified vulnerabilities or cyber incidents without delay. Additional authorization and procurement rules apply to public bodies and critical infrastructure.

Law No. 7590 of 24 July 2026 amended Cybersecurity Law No. 7545 by adding to Article 6(1) a duty to provide technical capability for lawful interception and intervention by institutions authorized by law, and it made a related amendment to Article 16(10). For engineering teams, the practical rule remains that interception and intervention mechanisms must be tied to a statutory mandate, defined authority, access control, logging, and oversight.

Cybersecurity incident handling and KVKK obligations must be designed together. A security purpose does not eliminate requirements of lawful, limited, and secure personal-data processing.

29. Cybercrime under the Turkish Criminal Code

The Turkish Criminal Code addresses unlawful access to information systems, unlawful interception of data transmissions, interference with systems, destruction or alteration of data, and certain tools/programs intended for cyber offences.

Unlawful recording, disclosure, dissemination, or acquisition of personal data is separately addressed in Articles 135 and following.

For penetration testing and red-team work, written authorization, target scope, permitted techniques, time window, data-handling constraints, and emergency contacts are operationally important. Good intentions alone do not create authorization.

30. Law No. 5651 and Internet publications

Law No. 5651 assigns different roles and duties to content providers, hosting providers, access providers, and other Internet actors. A publisher, a hosting company, and an ISP are not the same legal role.

Old procedural summaries of Article 9 should not be treated as current authority. Constitutional Court judgment E.2020/76, K.2023/172 annulled several rules introduced into Law No. 5651, with delayed effect.

For a real removal or blocking request, identify the affected right and verify the current consolidated provision, competent authority, and current procedure.

31. Electronic evidence and digital forensics

Electronic data can be evidence, but evidential reliability is not reduced to a hash value. Source identity, acquisition method, time, integrity, authority, chain of custody, and reproducibility matter together.

Civil Procedure Law Article 199 recognizes electronic data within the concept of document, while Article 205 contains a specific rule for data created with secure electronic signatures.

Search, copying, and seizure of computers, computer programs, and computer records are governed by Criminal Procedure Law Article 134. In judgment E.2023/128, K.2026/36 dated 12 February 2026, the Constitutional Court annulled parts of the first sentences of paragraphs 1 and 2 and postponed the effect of the annulment for nine months from publication in the Official Gazette. Digital-search procedure must therefore be checked against the text and safeguards in force on the date of the operation.

Technically sound forensic practice minimizes writes to the source, separates original and working copies, verifies integrity, records time-zone context and processing steps, documents scope and authority, and avoids unnecessary dissemination of unrelated personal data.

32. Electronic signatures

Under Law No. 5070, a secure electronic signature has the same legal result as a handwritten signature when statutory requirements are met.

Not every electronic approval is a secure electronic signature. A click-to-accept button, OTP, scanned signature image, and qualified secure electronic signature are different technical and legal mechanisms.

Legal acts subject to official form or special ceremony, and guarantee contracts, fall outside the general equivalence rule. Specific transactions should be checked against their current special legislation rather than relying on old course examples.

33. Electronic contracts and clickwrap

Electronic media do not prevent contract formation, but validity, form, consumer protection, and evidence requirements depend on the transaction.

A defensible clickwrap design can record:

contract version
user/session identity
timestamp
hash/version of displayed terms
affirmative acceptance event
termination/withdrawal process
separate privacy-notice and consent records

Those logs can themselves be personal data. Evidence needs do not justify unlimited retention.

34. E-commerce and commercial electronic communications

Law No. 6563 and secondary regulations impose information, record, platform, and commercial-communication duties on e-commerce service providers and intermediary service providers. Amendments adopted in 2022 significantly expanded the platform framework.

The Message Management System (İYS) is central to commercial electronic communication approval and rejection management. Consent should be modeled with channel, purpose, scope, source, date, and withdrawal state rather than a single Boolean flag.

Operational messages required to perform an order should not be silently repurposed as marketing messages.

35. Consumer law and digital content

Consumer Protection Law Article 48 and the Distance Contracts Regulation govern many purchases made through websites and mobile applications.

A general fourteen-day withdrawal right applies to distance contracts, subject to statutory exceptions. Certain services performed immediately in electronic form and intangible digital content delivered immediately are among the exceptions under defined conditions.

A product being "software" does not automatically determine the result; the transaction and current regulatory conditions must be examined.

36. Payment services and electronic money

Law No. 6493 regulates payment services, payment institutions, and electronic-money institutions, with the Central Bank of the Republic of Türkiye acting as the principal regulator/supervisor in this field.

A product label such as "wallet," "balance," or "payment intermediary" is not legally decisive. Model the movement of funds, who holds them, who receives the payment order, and whether the system falls within a closed-loop or other statutory structure.

37. Domain names, trademarks, and TRABİS

A domain name is technically a DNS identifier but may intersect with trademarks, trade names, personality rights, and unfair competition.

For .tr domains, TRABİS and the Internet Domain Names regulations provide an administrative/dispute-resolution framework.

Registering an available domain first does not automatically resolve every rights dispute. Brand and rights searches should precede product naming.

38. Trade secrets, confidentiality, and source code

Not every valuable technical asset is protected by copyright. Source code, architecture, model weights, training data, deployment secrets, customer lists, and optimizations may also be protected by confidentiality, contract, and unfair-competition rules.

The idea-expression distinction in copyright does not authorize disclosure of confidential know-how. An NDA, conversely, does not automatically transfer copyright.

39. Web content, links, caching, and embedded content

Online accessibility does not make content copyright-free. Linking to a page, copying it to another server, embedding it, generating thumbnails, and caching it are technically distinct acts.

Licence, reproduction/communication effects, database rights, contractual terms, and statutory exceptions may all matter.

Automated republication of another site's descriptions for SEO may raise copyright, database-right, and unfair-competition concerns.

40. Logging: security, evidence, and privacy

Logs are valuable for security and troubleshooting, but they can contain personal and confidential data.

A robust logging design avoids passwords/tokens/private keys, limits payloads, pseudonymizes identifiers where appropriate, separates log access, protects integrity and time synchronization, defines retention by data class, and resolves conflicts between deletion and legal hold.

"Log everything forever" increases both attack surface and legal risk.

41. Privacy by design and security by design

Compliance is not a document added after deployment. Data that are never collected cannot leak; access never granted cannot be abused; short retention limits long-term exposure.

Privacy by design includes minimization, controlled exports, separation of test and production data, lifecycle-aware deletion, and re-evaluation of third-party SDKs.

Security by design complements it through threat modeling, secure defaults, defense in depth, and fail-safe behavior.

42. AI systems and IT law

An AI system can simultaneously involve personal data, copyright, trade secrets, consumer rules, contracts, and cybersecurity.

A useful lifecycle is:

collection
-> training/fine-tuning
-> model artifact
-> prompt/retrieval
-> output
-> logs/telemetry
-> human or automated decision

Rights and legal bases should be evaluated at each stage. Retrieval-augmented generation does not erase the copyright status of the retrieved source. Model correctness does not imply copyright compliance.

Code generation therefore needs provenance/licence/security review; text generation needs source verification and plagiarism review.

43. An anti-plagiarism protocol for legal-technical writing

A high-assurance workflow is:

1. Extract topics, not sentences, from secondary materials.
2. Verify legal propositions against statutes, the Official Gazette, high-court decisions, or competent authorities.
3. Close the source and rebuild the explanation using an independent conceptual structure.
4. Cite article numbers, authority, and date where relevant.
5. Use verbatim quotation only when wording itself matters, keep it short, and mark it clearly.
6. Check licences/permissions separately for figures, tables, code, screenshots, and datasets.
7. Do not cite a primary source that you have not actually checked merely because a secondary source cites it.
8. Do not mistake synonym replacement or machine paraphrasing for originality.
9. Keep bibliography and body citations consistent.
10. Run similarity analysis before publication and manually inspect meaningful matches.

The goal is not an artificial "zero similarity score"; it is honest provenance and independent expression.

44. Engineering-law control matrix

For a new feature, a compact matrix can be used:

Feature: voice-record analysis

Personal data?        yes
Special category?     assess content/purpose
Cross-border flow?    inspect infrastructure/support
Copyrighted content?  assess recording/output rights
Retention?            purpose + statute + evidence need
Access?               role + audit + export controls
Cyber incident?       incident/reporting procedure
Third party?          contract + processor + subprocessors

The same method can be applied to face recognition, SIEM, cloud backup, e-commerce, employee monitoring, and LLM/RAG systems.

45. Common misconceptions

"I cited the source, so I may copy as much as I want." False. Citation and copyright permission are different.

"The repository is public, so the code has no copyright." False. Visibility does not erase licence conditions.

"Open source means there is no copyright." False. Open-source licences are permissions built on copyright.

"The idea is mine, so all rights in the program are mine." Not necessarily. Authorship, economic rights, and contract rights must be distinguished.

"Consent solves every KVKK issue." False. First identify the correct legal basis.

"The server is in Türkiye, so no cross-border transfer can exist." Not necessarily. Remote support and external services may create transfers.

"A security test is lawful because the tester has good intentions." False. Authorization and scope matter.

"Content produced with generative AI has no copyright or plagiarism risk." False. Provenance, human contribution, input sources, and the intended use must still be assessed.

46. Conclusion

The most reliable approach to IT law is to connect legal rules directly to system architecture. A schema influences minimization and retention; an API influences authorization and evidence; a dependency creates licence obligations; and a logging policy affects privacy, cybersecurity, and forensic reliability.

For plagiarism and copyright, the central rule is equally practical: learning technical ideas and independently implementing them is part of engineering; presenting another person's original expression or intellectual contribution as one's own is not. Know the source, know the right, produce independently, and preserve provenance.

References

1. Turkish Legislation Information System, Law No. 5846 on Intellectual and Artistic Works.
2. Ministry of Culture and Tourism, General Directorate of Copyright, Copyright Protection, General Questions, Voluntary Registration, and Remedies for Copyright Infringement. https://telifhaklari.ktb.gov.tr/
3. Council of Higher Education (YÖK), Directive on Scientific Research and Publication Ethics. https://www.yok.gov.tr/Sayfalar/Kurumsal/mevzuat/bilimsel-arastirma-ve-etik-yonetmeligi.aspx
4. Turkish Legislation Information System, Personal Data Protection Law No. 6698.
5. Personal Data Protection Authority, current guidance on personal data, data security, cross-border transfers, and Principle Decision No. 2026/347 dated 18 February 2026. https://www.kvkk.gov.tr/
6. Turkish Grand National Assembly, Cybersecurity Law No. 7545. https://www.tbmm.gov.tr/Yasama/Kanun/af1dfbdb-e3e3-4820-a493-0194504c63b4
7. Turkish Legislation Information System, Turkish Criminal Code No. 5237.
8. Turkish Legislation Information System, Internet Law No. 5651.
9. Constitutional Court, E.2020/76, K.2023/172 and press release dated 10 January 2024. https://www.anayasa.gov.tr/
10. Information and Communication Technologies Authority (BTK), Electronic Signature — General Information. https://www.btk.gov.tr/elektronik-imza-genel-bilgi
11. Turkish Legislation Information System, Electronic Signature Law No. 5070.
12. Turkish Legislation Information System, E-Commerce Law No. 6563.
13. Ministry of Trade, current e-commerce legislation and Message Management System (İYS). https://www.ticaret.gov.tr/ic-ticaret/mevzuat/elektronik-ticaret
14. Turkish Legislation Information System, Consumer Protection Law No. 6502 and Distance Contracts Regulation.
15. Ministry of Trade, Information on Distance Contracts, 17 August 2026. https://tuketici.ticaret.gov.tr/
16. Central Bank of the Republic of Türkiye, Law No. 6493 and payment-services legislation. https://www.tcmb.gov.tr/
17. Turkish Patent and Trademark Office, Industrial Property Law No. 6769 and Law No. 5147 on Integrated Circuit Topographies. https://www.turkpatent.gov.tr/mevzuat
18. Turkish Legislation Information System, Civil Procedure Law No. 6100.
19. Constitutional Court, E.2023/128, K.2026/36, judgment dated 12 February 2026 concerning Criminal Procedure Law Article 134. https://www.anayasa.gov.tr/
20. Turkish Grand National Assembly, Law No. 7590 of 24 July 2026, including amendments to Cybersecurity Law No. 7545. https://www.tbmm.gov.tr/
21. Personal Data Protection Authority, Principle Decision No. 2026/921 dated 29 April 2026 on biometric data for attendance tracking. https://www.kvkk.gov.tr/
22. Personal Data Protection Authority, Principle Decision No. 2026/1301 dated 1 July 2026 on online publication of personal data by public legal entities. https://www.kvkk.gov.tr/
23. Turkish Grand National Assembly, Bill No. 2/3634 concerning AI-era copyright issues under Law No. 5846; pending in committee. https://www.tbmm.gov.tr/Yasama/KanunTeklifi/547ff9e4-c8de-4271-a720-019d70f503ff