Legal Management of Supplier-Related Cybersecurity Risks under Turkish Law and European Union Law
Introduction
The accelerating pace of digitalization, the increasing integration of information and communication technologies into economic and social activities, and the growing reliance of organizations on third-party service providers to carry out their operations have significantly transformed the scope and nature of cybersecurity risks. In fact, attacks targeting information systems through the exploitation of existing security vulnerabilities, commonly referred to as cyberattacks, now have far-reaching implications, ranging from the protection of individuals’ privacy to the continuity of commercial operations. Moreover, security vulnerabilities in digital systems may have far-reaching consequences, potentially undermining economic stability and disrupting the functioning of society at a macroeconomic and societal level.[1]
In this context, cybersecurity is no longer confined to the protection of organizations’ own information systems; rather, it has evolved into a holistic area of risk management encompassing the activities of suppliers, service providers, and subcontractors that interact, directly or indirectly, with such systems. In particular, the potential for security vulnerabilities or cybersecurity incidents affecting suppliers’ information systems to extend to the information systems, operational continuity and data processed by the organizations they serve necessitates a legal assessment of cybersecurity risks arising from supplier relationships.
Since cybersecurity has gained increasing importance from a legal and regulatory perspective, efforts to adopt comprehensive legislation specifically addressing this field have also accelerated. In this regard, Directive (EU) 2016/1148 Concerning Measures for a High Common Level of Security of Network and Information systems Across the Union[2] (“NIS Directive”) adopted with the aim of establishing a common legal framework for the security of network and information systems within the European Union (“EU”), entered into force on 8 August 2016. Further to that, the EU’s regulatory approach to cybersecurity was further developed through Directive (EU) 2022/2555 on Measures for a High Common Level of Cybersecurity across the Union[3] (“NIS2 Directive” or “Directive”), which entered into force on 16 January 2023. By expanding the range of sectors and entities falling within its scope, the NIS2 Directive established a more comprehensive legal regime for the management of cybersecurity risks. While the legal framework governing cybersecurity in the EU evolved in this manner, cybersecurity in Türkiye had long been addressed through various legislative provisions and sector-specific regulations, with a comprehensive and standalone legislative framework only being adopted in 2025. In this context, the Turkish Cybersecurity Presidency was established pursuant to the Presidential Decree No. 177, published on 8 January 2025. Subsequently, Cybersecurity Law No. 7545[4] (“Cyber Law” or the “Law”) which was published in the Official Gazette and entered into force on 19 March 2025, established a comprehensive legal framework governing cybersecurity, including, in particular, fundamental cybersecurity principles, the management of cybersecurity risks, and the obligations of public institutions and natural and legal persons. Given the broad scope of the Cyber Law and the direct relevance of cybersecurity to activities across various sectors, the legal obligations arising in the field of cybersecurity are expected to become more clearly defined across different areas of business activity in the coming years, particularly through the adoption of secondary legislation and the development of administrative practices.
In light of these developments, it has become increasingly important to assess whether organizations’ cybersecurity obligations extend beyond the technical and organizational measures implemented to protect their own information systems, as well as the legal responsibilities that may arise in connection with the selection, auditing, and ongoing monitoring of suppliers. Indeed, depending on its nature, a supplier-related cybersecurity incident may give rise to various legal consequences not only under cybersecurity legislation, but also under data protection laws and contractual relationships between the parties. Accordingly, the management of supplier-related risks constitutes a multifaceted legal issue requiring a comprehensive legal assessment of obligations arising under cybersecurity legislation, alongside those stemming from data protection legislation and contract law.
The evolving legal framework governing cybersecurity and the increasing clarification of the obligations arising in this field require organizations not only to ensure the security of their own information systems, but also to take into account cybersecurity risks that may arise from third parties with whom they collaborate in the course of their operations. In fact, the increasing reliance of organizations on third parties for a wide range of services, including information technology infrastructure, software, cloud computing, and data processing, has made supplier relationships a critical component of cybersecurity risk management. In this regard, the selection of suppliers, assessment of their cybersecurity capabilities, auditing of their activities, and implementation of appropriate measures to address potential security incidents are of significance not only from a technical and operational perspective, but also from a legal standpoint. Indeed, depending on specific circumstances of a case, a supplier-related cybersecurity incident may give rise to various legal consequences not only under cybersecurity legislation, but also under data protection laws and the contractual relationships between the parties. Therefore, the management of supplier-related risks constitutes a multifaceted issue requiring an integrated assessment of obligations arising particularly under these three areas of law, together with the legal, technical, and organizational measures that may be necessary to ensure compliance with such obligations.
Against this background, this article seeks to examine the legal management of supplier-related risks arising in the context of cybersecurity incidents through three interrelated legal perspectives: cybersecurity law, data protection law, and contractual risk management. To this end, this article will examine (i) the obligations arising under Cybersecurity Law and related legislation, (ii) the management of cybersecurity risks through contractual mechanisms, and (iii) supplier-related data security risks under Personal Data Protection Law No.6698[5] (the “PDP Law”) together with the legal liability regime applicable to data controllers and data processors. The analysis will be followed by practical recommendations aimed at addressing the identified legal and cybersecurity risks.
Supplier Security Obligations Under the Cyber Law and EU Regulations
Pursuant to Article 2 of the Cyber Law, the Law applies to public institutions and organizations, as well as natural and legal persons, that maintain a presence, conduct activities, or provide services in cyberspace. Given that Article 3 of the Law defines the term “cyberspace” as “the environment consisting of all information systems directly or indirectly connected to the Internet, electronic communications networks or computer networks, and the networks interconnecting such systems”, it is evident that the Cyber Law has implications not only for entities operating directly in the field of cybersecurity, but also for a wide range of organizations across various sectors that rely on information systems in conducting their operations.
In addition to the broad scope of application of the Cyber Law, the cybersecurity obligations arising from supplier relationships for entities falling within the scope of the Law (individually the “Organization”, collectively the “Organizations”) require separate examination. Indeed, Article 7 (1) (c) of the Cyber Law establishes a specific obligation concerning the procurement activities of Organizations. Pursuant to this provision, cybersecurity products, systems, and services intended for use by public institutions and organizations or in critical infrastructures must be procured from cybersecurity experts, manufacturers, or companies authorized and certified by the Cybersecurity Presidency (the “Presidency”). Nevertheless, cybersecurity risks arising from supplier relationships should not be assessed solely within the scope of the provision. In this regard, Article 7(1) (b) of the Cyber Law requires the implementation of cybersecurity measures prescribed by applicable legislation, while Article 7(1) (d) imposes an obligation to comply with requirements set forth in regulatory instruments issued by the Presidency. Although these provisions do not expressly impose specific obligations concerning supplier risk management, where the applicable legislation or regulatory instruments prescribe measures relating to supplier security, such obligations may also become applicable in the context of supplier relationships.
On the other hand, under EU law, Article 21 of the NIS2 Directive, which constitutes one of the principal legislative instruments governing cybersecurity risk management, requires entities classified as essential and important entities[6] within the meaning of Article 3 of the Directive to implement appropriate and proportionate technical, operational, and organizational measures to manage cybersecurity risks. Article 21(2) of the Directive sets out the minimum cybersecurity risk-management measures to be implemented by such entities, expressly including supply chain security alongside other areas such as risk analysis, incident handling, and business continuity. In fact, pursuant to Article 21 (2) (d) of the Directive, “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers” is expressly included among the minimum cybersecurity risk-management measures to be implemented. In connection with this, Article 21 (3) of the Directive further provides that, when determining appropriate supply chain security measures, entities must take into account the specific vulnerabilities of each direct supplier and service provider, as well as the overall quality of their products and their cybersecurity practices, including secure development procedures.
Furthermore, under EU law, obligations concerning the management of supplier-related cybersecurity risks are not limited to the NIS2 Directive. Particularly, Regulation (EU) 2024/2847, the Cyber Resilience Act[7] (the “CRA”), which established horizontal cybersecurity requirements for products with digital elements, also imposes obligations relating to supply chain security. Indeed, pursuant to Article 13 (5) of the CRA, manufacturers of products with digital elements are required to exercise due diligence when integrating components sourced from third parties into their products, with a view to ensuring that such components do not compromise the cybersecurity of the products concerned. Accordingly, manufacturers’ cybersecurity obligations are not confined to components developed in-house but also extend to the assessment and management of cybersecurity risks arising from product components sourced from third parties.
Accordingly, while NIS2 Directive focuses on addressing risks arising from supplier relationships as part of organizations’ cybersecurity risk management, the CRA focuses on product and component security. Both instruments thus approach supply chain security from different perspectives and complement each other within the EU regulatory framework.
Supplier Risk Management and Preventive Measures under the Cyber Law and EU Regulations
As explained above, the specific procurement obligation set out in Article 7(1) (c) of the Cyber Law is limited to cybersecurity products, systems, and services intended for use by public institutions and organizations or in critical infrastructures. In this context, the sectors constituting critical infrastructure, as defined under Article 3 of the Cyber Law, were determined by a decision adopted at the meeting of the Cybersecurity Board (the “Board”) held on 5 May 2026.[8] Accordingly, sectors such as energy, finance, healthcare, electronic communications, and transportation were identified as critical infrastructure sectors. By contrast, Article 21 of the NIS2 Directive requires essential and important entities to assess cybersecurity risks arising from their relationships with direct suppliers and service providers, without limiting such assessments to specific categories of products or services. Accordingly, NIS2 Directive adopts a broader, risk-based approach, both in terms of the entities subject to the relevant obligations and the scope of supplier relationships covered.
Considering the regulatory provisions discussed above, there is no doubt that, under Turkish law, procurement activities falling within the scope of Article 7(1) (c) of the Cyber Law must comply with the obligations prescribed therein.
Nevertheless, cybersecurity risks arising from supplier relationships are not confined to critical infrastructures or organizations operating in sectors subject to specific regulatory requirements. Indeed, where third-party service providers are granted access to the information systems of the organizations they serve or provide services through such systems, cybersecurity incidents affecting those providers may also significantly compromise the operations, information systems, and data security of the recipient organizations.
Therefore, under Turkish law, it is important for Organizations that are not subject to an explicit supplier risk management obligation under the Cyber Law to assess supplier-related risks and implement technical, organizational, and contractual measures aimed at mitigating such risks. In this context, it may be recommended that Organizations assess the cybersecurity capabilities of their suppliers and expressly stipulate in their contracts with suppliers, the technical and organizational security measures to be implemented, security incident notification obligations, and the audit rights of the Organization receiving the services over its suppliers. Furthermore, even for organizations that may be considered to fall outside the scope of the Cyber Law, the procurement of products or services from third parties through information systems may give rise to supplier-related cybersecurity risks. Accordingly, it remains important to establish appropriate technical, organizational and contractual safeguards to mitigate such risks.
In fact, Section 3.2. of the guide entitled “Good Practices for Supply Chain Cybersecurity” (the “ENISA Guide”)[9], published by the European Union Agency for Cybersecurity (“ENISA”), which is not a legally binding instrument but provides recommendations on good practices, outlines various good practices, including the identification and classification of suppliers, the assessment of supplier-related risks, the implementation of measures to mitigate such risks, and the regular monitoring of supplier performance. These measures may also be adopted by organizations that are not subject to explicit supplier risk management obligations under Turkish or EU cybersecurity legislation, as part of a prudent and comprehensive risk management approach. Nevertheless, the ENISA Guide recommends that such measures be applied primarily to information and communication technology products, systems, and services that are considered critical to the recipient organization. In determining such criticality, the Guide further recommends considering factors such as the impact of the relevant service on organization’s operations, the value of the information processed, and business continuity requirements. Considering this, supplier-related risks should be managed with due regard to the needs of the recipient organization and the criticality of the products or services provided.
Supplier Related Risk Management and Preventive Measures under PDP Law and the EU General Data Protection Regulation (“GDPR”)
The management of cybersecurity risks arising from supplier relationships is of significance not only under cybersecurity legislation but also from a data protection law perspective. In this regard, where personal data are processed or accessed in connection with information technology products and services procured from third-party service providers, cybersecurity incidents originating from such suppliers may also give rise to personal data security breaches. This is because, when assessing supplier relationships from a data protection law perspective, it is important to recognize that, depending on the nature of the services provided, third-party service providers may process personal data on behalf of the organizations they serve, and, accordingly, may qualify as data processors acting under the authority of the recipient organization in its capacity as data controller. Conversely, where the supplier independently determines the purposes and essential means of the relevant personal data processing activities, it may also qualify as a data controller.
At this point, it should be noted that, pursuant to Article 12(2) of the PDP Law, where personal data are processed by another natural or legal person on behalf of the data controller, the data controller, and the data processor are jointly responsible for implementing the necessary technical and administrative measures to ensure personal data security. Under GDPR, however, the responsibilities of data controllers and data processors concerning data security are regulated under a different framework. Unlike Article 12(2) of the PDP Law, Article 32 of the GDPR does not expressly provide that data controllers and data processors are jointly responsible for implementing the necessary security measures. Instead, it imposes an obligation on both parties to implement appropriate technical and organizational measures. Nevertheless, Article 82 of the GDPR separately provides for joint and several liability in respect of compensation for damage arising from infringements of the GDPR, where multiple controllers or processors are involved in the same processing activity and are responsible for the damage under Article 82. For the avoidance of doubt, such liability is not limited to failures to implement appropriate data security measures.
Furthermore, Article 28(3) of the GDPR expressly requires that the relationship between a data controller and a data processor be governed by a binding contract or other legal act and specifies the minimum elements that such an arrangement must contain. In this context, the provision requires contractual arrangements addressing matters such as the implementation of technical and organizational measures to ensure data security, the provision of assistance to the data controller in fulfilling its obligations concerning personal data breach notifications and the exercise of data subject rights, and the data controllers’ audit rights.
Under Turkish law, although the PDP Law does not expressly prescribe the mandatory elements to be included in contracts between data controllers and data processors, the Personal Data Security Guide (Technical and Organizational Measures) (“Data Security Guide”)[10] recommends that data controllers enter into contracts with data processors and include specific provisions aimed at ensuring personal data security. By contrast, Article 28 of the GDPR expressly requires that the relationship between a data controller and a data processor be governed by a binding contract or other legal act containing certain minimum mandatory elements.
Nevertheless, beyond mandatory contractual elements prescribed under the GDPR and the recommendations set out in Data Security Guide, it would also be beneficial to include additional provisions in contracts between the parties to ensure the effective management of supplier-related data security risks. In this context, expressly specifying concrete timeframes for notifying personal data breaches, detailing the corrective measures to be implemented following a breach and the parties’ obligations to cooperate throughout the process, and clearly regulating legal mechanisms such as compensation for damages arising from breaches of contractual obligations, right of recourse between the parties, contractual penalties, and termination for cause would significantly contribute to preventing supplier-related risks and managing the legal consequences or breaches that occur.
Conclusion
In conclusion, the legal management of supplier-related cybersecurity risks extends beyond mere compliance with obligations under applicable legislation and requires a comprehensive, risk-based approach to supplier relationships. While the obligations established under the Cyber Law and data protection legislation in Türkiye provide an important legal framework for managing supplier-related risks, EU regulations, particularly NIS2 Directive, establish an approach aimed at addressing supply chain security in a more comprehensive and systematic manner. Accordingly, Organizations should go beyond compliance with explicit statutory obligations and assess cybersecurity and personal data security risks throughout the entire lifecycle of supplier relationships, from supplier selection to the termination of contractual arrangements. They should also reinforce appropriate technical and organizational measures with contractual safeguards and regularly monitor suppliers’ compliance with these obligations. Such an approach would not only contribute to preventing supplier – related security breaches but also help mitigate the potential impact of such breaches on personal data and reduce the associated legal risks.
- Mehmet Bedii, Kaya (2025), CyberSecurity Law, p.3.
- Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems accross the Union, https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016L1148 (Accessed: 20 October 2026)
- Directive (EU) 2022/2555 on measures for a high common level of cybersecurity accross the Union https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32022L2555 (Accessed: 20 October 2026)
- Cybersecurity Law No.7545 https://mevzuat.gov.tr/mevzuat?MevzuatNo=7545&MevzuatTur=1&MevzuatTertip=5 (Accessed: 20 October 2026)
- Personal Data Protection Law No.6698 https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=6698&MevzuatTur=1&MevzuatTertip=5 (Accessed: 20 October 2026)
- For the purposes of this Directive, the following entities shall be considered to be essential entities: (a) entities of a type referred to in Annex I which exceed the ceilings for medium-sized enterprises provided for in Article 2(1) of the Annex to Recommendation 2003/361/EC; (b) qualified trust service providers and top-level domain name registries as well as DNS service providers, regardless of their size; (c) providers of public electronic communications networks or of publicly available electronic communications services which qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC; (d) public administration entities referred to in Article 2(2), point (f)(i); (e) any other entities of a type referred to in Annex I or II that are identified by a Member State as essential entities pursuant to Article 2(2), points (b) to (e); (f) entities identified as critical entities under Directive (EU) 2022/2557, referred to in Article 2(3) of this Directive; (g) if the Member State so provides, entities which that Member State identified before 16 January 2023 as operators of essential services in accordance with Directive (EU) 2016/1148 or national law.
- EU Cyber Resilience Act, https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L_202402847, (Access Date: 20.10.2026)
- Official Announcement Regarding the Cybersecurity Board Meeting Held on 5 May 2026, https://www.iletisim.gov.tr/turkce/haberler/detay/siber-guvenlik-kurulu-cumhurbaskani-erdogan-baskanliginda-toplandi-05-05-26 (Access Date: 21 October 2026)
- European Union Agency for Cybersecurity (ENISA), “Good Practices for Supply Chain Cybersecurity, p. 21-22, https://www.enisa.europa.eu/sites/default/files/publications/Good%20Practices%20for%20Supply%20Chain%20Cybersecurity.pdf (Access Date: 21 October 2026)
- Personal Data Security Guide (Technical and Organizational Measures) ), https://kvkk.gov.tr/SharedFolderServer/CMSFiles/7512d0d4-f345-41cb-bc5b-8d5cf125e3a1.pdf,, (Access Date: 21 October 2026)
All rights of this article are reserved. This article may not be used, reproduced, copied, published, distributed, or otherwise disseminated without quotation or Erdem & Erdem Law Firm's written consent. Any content created without citing the resource or Erdem & Erdem Law Firm’s written consent is regularly tracked, and legal action will be taken in case of violation.
Other Contents
As a result of the globalised world economy, the acceleration of digitalisation, the increasing prevalence of multinational corporate structures, and the growing integration of technological tools into business processes, the cross-border flow of personal data has become an inevitable and continuous phenomenon…
In November 2025, the European Commission ("Commission") launched the EU Digital Omnibus Regulation Proposal ("Digital Omnibus"), a wide-ranging legislative initiative aimed at streamlining the EU's existing digital regulatory framework. Digital Omnibus…
As part of the 2020 European Data Strategy, the Regulation on harmonized rules on fair access to and use of data (Data Act or Act) aims to boost the European Union’s (EU) data economy by maximizing data access and data use in a competitive and fair environment.
On September 2025, the Court of Justice of the European Union (“CJEU”) delivered its judgment in Single Resolution Board (SRB) v. European Data Protection Supervisor (EDPS), providing some clarification on the identifiability of data under the EU data protection regime. The case examined whether information that...
In Türkiye, it has recently become increasingly common, especially in retail stores, to send verification codes to data subjects by SMS during the provision of goods and services and to process personal data in this way. In the complaints submitted to the Personal Data Protection Board (“Board”), it has been...
In contemporary workplaces, employers frequently implement surveillance systems for reasons such as ensuring occupational health and safety, maintaining workplace order, operating internal control mechanisms, and preventing potential misconduct. However, such monitoring practices often raise significant...
Although the Turkish Personal Data Protection Law No. 6698 (KVKK) stipulates certain rules on cross-border personal data transfer, the effective functioning of the transfer rules was limited over time due to some difficulties in practice. In particular, until late 2024, the application process for permission to transfer...
Personal Data Protection Law numbered 6698 (“PDPL”) was first drafted based on the Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals about the processing of personal data and on the free movement of such data, and entered into force in 2016...
Typically, when an employee departs, their corporate email account remains active and accessible to the employer for a period of time. During this time, the email archive and new incoming messages are forwarded to the employee's manager or another colleague...
In today's world, we now have the opportunity to purchase many products and services through e-commerce platforms with a single click from wherever we are. During these purchases, our personal data are collected and used through the websites or mobile applications of e-commerce platforms for various...
The processing of genetic data has the potential to affect not only the data subjects but also the persons with whom the data subject is genetically connected. “The Guidelines on Issues to be Considered in the Processing of Genetic Data” (“Guidelines”) published by the Personal Data Protection Authority...
In its decision regarding Case-300/21 and dated May 4, 2023, the Court of Justice of the European Union (“CJEU”) evaluates the right to compensation for an infringement of the European Union General Data Protection Regulation (“GDPR”) regulated in Article 82 of the GDPR. The CJEU decided that a mere...
The Personal Data Protection Law numbered 6698 (“PDPL”) introduces definitions for many concepts such as personal data, data controller, data processor and data subject. In terms of understanding and interpreting these concepts, secondary legislation, Personal Data Protection Authority (“Authority”) guidelines...
The Covid-19 pandemic and recent technological developments have significantly accelerated the digital transformation of all sectors. However, this rapid change especially in the financial sector (mobile banking, e-commerce, contactless payments, etc.) has brought some risks along with making life extremely...
Smartwatches have undeniably revolutionized our lives in the past decade. Apart from their core function as a timepiece, these wearable computers packaged in the form of a watch enable us to answer incoming calls, reply to messages and skim through social media notifications in seconds. Their steady rechargeable...
The Personal Data Protection Authority (“DPA”), on 16.06.2022, published the Draft Guidelines on Examination of Loyalty Programs within the Scope of Personal Data Protection Legislation (“Draft Guidelines”). The public has until 16.07.2022 to submit comments on them, and after these are evaluated...
The German Competition Authority (“Bundeskartellamt”) had previously found Meta (formerly Facebook) responsible for abusing its dominant position in the social network market by collecting and processing the personal data of its users without their consent and imposed measures on Meta and its associated...
Banks process large volumes of personal data in their daily operations. In order to deal with this sensitive information, the Turkish Personal Data Protection Authority, in cooperation with the Banks Association of Turkey, published Good Practice Guidelines on Personal Data Protection in the Banking...
The procedural rules on mass claims within European Union (“EU”) Member States is not uniform. To improve the position of consumers who might wish to make such claims, the European Parliament passed the Collective Redress Directive (“Directive”). The impact of the Directive is expected to...
In February 2020, the European Commission (“Commission”) published “A European Strategy for Data” as part of a wider drive concerning digital transformation and policy. Through this communication, the European Union (“EU”), defining itself as having a leading role in the data economy...
The Regulation on Protection and Processing of Personal Data by the Social Security Institution (the “Regulation”), the purpose of which is to determine the procedures and principles for processing data obtained within the scope of the duties and authority of...
The Personal Information Protection Law of the People’s Republic of China (“PIPL”) passed at the 30th meeting of the Standing Committee of the 13th National People’s Congress on 20 August 2021 and entered into force on 1 November 2021 as per Article 74...
In today's world, there is no doubt that data has become one of the most valuable assets and resources for some companies. The ability to collect, store, process, and analyze data on a large scale has dramatically changed...
