Turkey

Summary

Turkey presents moderate crawling risk with well-established legal frameworks. The Turkish Penal Code Arts. 243-244 criminalise unauthorized access to information systems and interference with their operation; the paradigm case is intrusion past a security mechanism, not polite reading of public pages. KVKK (Law No. 6698, 2016) is the primary personal data framework, closely modelled on the EU GDPR and independently enforced by the KVKK Board; a 2024 reform restructured cross-border transfer rules (requiring adequacy decisions, SCCs, or BCRs — no country has yet received an adequacy decision from Turkey). Copyright Law No. 5846 Annex Art. 8 (added 2004) implements an EU-style sui generis database producer right (15-year term) directly transposing EU Directive 96/9/EC and protecting substantial investment in databases; Turkish courts have recognised this right. No TDM or research scraping exception exists in Turkish copyright law — Law 5846's exception list is closed and excludes automated mass extraction. Turkey is an EU candidate but not bound by EU law — EU DSM Directive TDM provisions (Arts. 3-4) do not apply. Web scraping is not directly regulated; risk flows from Penal Code, KVKK, contract, and database right.