IT & Technology Law

Cybersecurity law covers the rules for protecting personal data, business information and critical infrastructure in the digital environment. Regulations include mechanisms for preparing for, preventing, detecting and responding to cyber attacks.

The core instrument is Cybersecurity Law No. 7545. It regulates the protection of critical infrastructure, the governance model for cybersecurity and the powers of the Cybersecurity Directorate. Presidential Decree No. 192 has also added digital government and artificial intelligence to the Directorate’s remit.

For Corporate Cyber Incident Response Teams (SOME) and critical infrastructure operators, the principle of reporting cyber incidents to the National Cyber Incident Response Center (USOM) “without delay / immediately” is essential. Depending on the criticality of the incident, the initial notification or early warnings are made within the first 24 hours. This duty is separate from the Data Protection Board notification for personal data breaches (72 hours); both must be assessed together.

Contain the incident, preserve logs and other evidence unaltered, and assess notification duties from the moment the incident is detected. Corporate Cyber Incident Response Teams (SOME) and critical infrastructure operators must report to USOM without delay, with the initial notification or early warning made within the first 24 hours depending on the criticality of the incident. Where personal data is affected, the Personal Data Protection Board must additionally be notified as soon as possible and within 72 hours of learning of the breach.

Public bodies must follow the project management principles set by the Directorate in their IT projects. For the private sector, compliance with data governance and AI standards is expected to become a legal requirement in the near future. Sector-specific duties (e.g. finance, energy, health) must be reviewed separately.

They may, if the company provides services or sells products on the EU market. NIS2 tightens incident management and reporting duties for organisations in certain sectors; the Cyber Resilience Act sets cybersecurity standards for products placed on the EU market. Applicability depends on the company’s activities and EU nexus and must be assessed case by case.

Access blocking restricts the accessibility of content through techniques such as IP, DNS or URL blocking, whereas content removal takes the content down at its source. Blocking should be viewed as a temporary solution, and content removal routes should be pursued where possible. Digital content can be subject to several legal systems, so the applicable rules must be identified at the outset.

Disputes between a domain name and a trademark can be handled through alternative mechanisms such as the UDRP and URS. These usually examine similarity or likelihood of confusion with the mark, bad-faith registration and the absence of a legitimate right in the domain. For start-ups in particular, rapid procedures such as the URS may be considered.