Internet Law
Internet law governs the rights and obligations of businesses and individuals operating online.
Services
Compliance under Law No. 5651
Compliance programmes for hosting, content and access providers, removal of unlawful content and advice on data requests from judicial authorities.
KVKK and GDPR Compliance
Advice on data protection compliance, VERBİS registration, data processing policies and the process after a data breach.
Cybersecurity and Incident Response
Notification to the relevant authorities after data breaches, cybersecurity policies and representation in legal proceedings arising from cybercrime.
E-Commerce Regulation
Preparation of distance sales agreements, privacy policies, terms of use and advertising campaigns in line with the regulations.
Protecting IP Rights Online
Takedown proceedings and litigation over online infringement of trademarks, copyright and other intellectual property rights.
Platform Regulation
Compliance processes, user agreements and privacy policies for regulated sectors such as social media, digital gaming and fintech.
Mediation and Dispute Resolution
Mediation and alternative dispute resolution for disputes in e-commerce, data breaches and between platform users.
Frequently asked questions
- How quickly must a personal data breach be notified under KVKK?
- The data controller must notify the Personal Data Protection Board within 72 hours of becoming aware of the breach. Affected data subjects must be informed within the shortest reasonable time.
- Who must register with VERBİS?
- Data controllers processing personal data must as a rule register with the Data Controllers' Registry, and the Board has set exemptions using criteria such as employee numbers and annual balance sheet totals. Failure to register is subject to administrative fines.
- How is content that infringes personality rights removed online?
- Under Article 9 of Law No. 5651 the affected person may apply to the content or hosting provider, or ask a criminal judgeship of peace directly to order removal of the content and blocking of access. The judgeship rules within 24 hours without a hearing, and the decision applies only to the infringing content and must be proportionate.
- When may personal data be transferred abroad?
- Transfers may be made to countries the Board has declared as providing adequate protection, or on the basis of appropriate safeguards such as standard contractual clauses or binding corporate rules. Where no such safeguard exists, only the incidental situations listed in the law apply, and cloud service use usually counts as a transfer abroad.
- What are the core legal obligations of an e-commerce site?
- Distance contract rules require a pre-contractual information form, proper notice of the right of withdrawal and compliance with delivery periods. ETBİS registration, consent management through İYS for commercial electronic messages and KVKK disclosure duties also apply.
Related insights
14 July 2026
A 2026 data protection checklist
The data inventory, privacy notices, processor contracts and breach reporting are the items to revisit during the year.
2 October 2025
Distance selling in e-commerce
Pre-contract information, the right of withdrawal, promotional messaging and returns are the points for online shops to check.
Contact and case review
You can reach the firm by form or email.