This is the English version of a Turkish article. The original, with further detail and linked petition templates, is at Bilişim Suçları: İnternet Ortamında İşlenen Suçlar ve Haklarınız.
In cybercrime the first hours are decisive: records can be deleted, accounts closed, and content keeps spreading. So the order is — fix the evidence, apply to the prosecutor, and where necessary obtain an order blocking access. Offences against the integrity of a system are prosecuted of the authorities' own motion; some acts, such as insult, require a complaint.
Unauthorised access to social media accounts, online fraud, the unlawful sharing of personal data and online harassment are now everyday risks. Articles 243–245 of the Criminal Code and Act No. 5651 on internet publications contain the core provisions.
The Principal Offences
- Unlawful access to an information system (TCK art. 243). Entering, or remaining in, an information system unlawfully. Accessing another person's e-mail, accounts or social media profiles without permission falls here.
- Obstructing or damaging a system, destroying or altering data (TCK art. 244). Deliberately disrupting a system's operation, or deleting or altering data. Deploying viruses or malware falls within it.
- Misuse of bank or credit cards (TCK art. 245). Obtaining, copying or using another person's card details — a serious offence.
- Phishing. Obtaining users' credentials through spoofed bank or corporate websites, treated as aggravated fraud under TCK art. 158.
- Online harassment and stalking. Persistently messaging, following or applying psychological pressure online engages the offences against personality rights and threat.
| Offence | Basis |
|---|---|
| Unlawful access to an information system | TCK art. 243 |
| Obstructing a system, destroying or altering data | TCK art. 244 |
| Misuse of a bank or credit card | TCK art. 245 |
| Unlawful recording of personal data | TCK art. 135 |
| Disseminating personal data | TCK art. 136 |
| Fraud using an information system as the means | TCK art. 158/1-f |
| Insult on social media | TCK art. 125 — requires a complaint within 6 months |
| Violation of privacy | TCK art. 134 — requires a complaint |
Where the offender is unknown, ask the prosecutor to obtain the IP and traffic records. Retention periods are limited, so do not delay.
Insult and Harassment on Social Media
- Preserving evidence. Posts can be used as evidence, but a bare screenshot may not suffice. To show the content has not been altered, obtain a notarial record or capture it through an authorised electronic signature service.
- Identifying the account. To identify the account holder, a complaint is made to the prosecutor and the user data requested from the platform. Platforms provide information to the Turkish authorities under their legal obligations.
- Anonymous accounts. Posts from fake or anonymous accounts can still be offences; the offender can be identified through the IP address and digital traces.
- Act No. 5651. Blocking content and restricting access are dealt with under this Act. For posts attacking private life, or amounting to defamation or insult, a URL-based removal order can be obtained.
"A person who unlawfully enters an information system is punished with imprisonment of up to one year."
TCK art. 243/1
Personal Data Breaches
- Sharing data without consent. Publishing a person's photograph, identity details, telephone number or health data on social media without consent breaches Act No. 6698 and may also engage the offence of violation of privacy (TCK art. 134).
- Complaint to the data protection authority. Where a breach is established, the authority imposes administrative fines and can order the data to be deleted.
- A damages action. Pecuniary and non-pecuniary damages for a data breach can be claimed in the civil courts. The regulatory complaint and the civil action proceed independently.
- Companies' obligations. A company suffering a data breach must notify the authority within 72 hours. Failure attracts heavy administrative fines.
How to Report
- A petition to the public prosecutor where you live or where the offence was committed, setting out the type of offence, the date, the digital evidence and what is known about the offender.
- The cybercrime units within provincial police directorates, which are specialised in this field.
- The online reporting portal, particularly for complaints about internet content.
- Evidence security. Preserve every item of digital evidence before reporting. Screenshots, messages, e-mails and URLs gain legal weight through a notarial record or an electronically signed capture. Preserve the evidence before blocking or reporting the account.
If you are being harassed on social media, capture the screenshots and URLs of everything before blocking the account. Removing the content or reporting the account can destroy the evidence — record it first, then report.
Frequently Asked Questions
Someone accessed my account. Is that an offence?
Yes. Unlawful access to an information system is an offence under TCK art. 243, and altering or destroying data falls under art. 244.
Are screenshots enough as evidence?
Not necessarily. Support them with a notarial record or an electronically signed capture so that authenticity is not in issue.
Can an anonymous account be identified?
Yes, through IP addresses and digital traces, on a request made through the prosecutor.
How long do I have to complain about an insult?
Insult requires a complaint within six months of learning of the act and the offender.
My personal data was shared. What can I do?
Complain to the data protection authority, and bring a civil claim for damages. The two proceed independently.