LEGAL GLOSSARY
Cybercrime
Cybercrime is a general term for offenses directed at information systems and the data in them, or committed by using information systems as a tool. The Turkish Penal Code has no separate offense type under this name; the core provisions are Articles 243–245/A of Law No. 5237 in the section “Offenses in the Field of Information Technology.” Theft and fraud committed by using information systems, in turn, are punished more severely as aggravated forms of the offenses of theft and fraud.
Scope
The offenses in the field of information technology under the Turkish Penal Code (TCK) are as follows: unlawfully accessing an information system or continuing to remain in it, and unlawfully monitoring data transmissions within the system by technical means (Article 243); obstructing or disrupting the operation of a system, and corrupting, destroying, altering or making data inaccessible (Article 244); using another person’s bank or credit card without that person’s consent, and producing or using a forged card (Article 245); and manufacturing, selling or possessing devices, programs or passwords made for these offenses (Article 245/A). Security measures are imposed on legal entities that benefit from these offenses (Article 246). Committing theft and fraud through the use of information systems is regarded as an aggravated form (Articles 142/2-e, 158/1-f). Cybersecurity Law No. 7545 also provides for separate offense types, such as making available to unauthorized access, sharing or offering for sale, by means of a data leak, personal data or institutional data relating to a critical public service that are located in cyberspace (Article 16).
Practical importance
In cybercrimes the evidence is mostly digital; searching, copying and seizing the suspect’s computer and records depend on the conditions in Article 134 of the Code of Criminal Procedure (CMK). For a company that has been attacked, it is important to preserve the records (logs) and to document the incident; if personal data has been obtained by others, the data controller is obliged to notify the persons concerned and the Personal Data Protection Board as soon as possible (Law No. 6698, Article 12/5). A person who, for the purpose of unjust benefit, gives a bank, payment or crypto-asset account to another person to be used in fraud may also be held liable for participation; a sentence reduction is provided for the case where the participation remains limited to this contribution (TCK Article 158/4). The ratification of the Convention on Cybercrime was approved by Law No. 6533.
Commonly confused concepts
Cybercrime should not be confused with a cyber incident or a cyberattack. Law No. 7545 defines a cyber incident as a violation of the confidentiality, integrity or availability of information systems or data, and a cyberattack as intentional actions carried out with the aim of eliminating these qualities (Article 3); not every cyber incident constitutes an offense, and for an offense the act must be defined as an offense in the law. The unlawful recording or obtaining of personal data, on the other hand, is regulated separately from offenses in the field of information technology in Articles 135–136 of the Turkish Penal Code; the same incident may bring both groups of offenses into play together.
Sources and scope
- Presidency of the Republic of Türkiye Legislation Information System (T.C. Cumhurbaşkanlığı Mevzuat Bilgi Sistemi) — Law No. 5237, Turkish Penal Code · Art. 142/2-e, 158/1-f, 158/4, 243–246(accessed: September 24, 2026)
- Presidency of the Republic of Türkiye Legislation Information System (T.C. Cumhurbaşkanlığı Mevzuat Bilgi Sistemi) — Law No. 7545, Cybersecurity Law · Art. 3, 16(accessed: September 24, 2026)
- Official Gazette (Resmî Gazete) — Law No. 6533 on the Approval of the Ratification of the Convention on Cybercrime · Art. 1(accessed: September 24, 2026)
The explanation is for general information; a specific case must be assessed separately.