Cybersecurity

Cybersecurity sits at the centre of several converging regulatory regimes. In the EU, the NIS2 Directive imposes mandatory security measures and breach notification timelines on essential and important entities. The Cyber Resilience Act introduces product-level security requirements for hardware and software placed on the EU market. In Türkiye, the Information Technologies and Communication Authority (BTK) and sector-specific regulators impose their own incident reporting and security standards. Navigating these parallel frameworks, and understanding where they overlap or conflict, requires counsel experienced in both technology and regulatory law.

For cybersecurity vendors, we advise on product compliance, software liability clauses, penetration-testing agreement structures, bug bounty programme terms, and the contractual allocation of risk in managed security service (MSSP) arrangements. When a product is licensed across the EU, Türkiye, and the US, we ensure the contractual and regulatory layer is coherent across all three.

When incidents occur, speed and precision matter. We guide clients through data breach response: mandatory notification to supervisory authorities under GDPR and KVKK, internal containment documentation, regulatory correspondence, and, where necessary, coordination with law enforcement. We also advise on insurance coverage positions and potential liability exposure toward affected data subjects and counterparties.