title: "Turkish Code of Obligations Article 49 and Digital Evidence: Digital Forensics in Tort Compensation" description: "How does TBK 49 tort compensation work in the digital environment? Pecuniary and non-pecuniary damages with digital forensics evidence in social media defamation, deepfake, doxxing, hacking, and reputational harm. The combination of HMK 187, TCK 132-135, and KVKK Article 14." date: "2026-06-01" category: "Law and Digital Forensics" tags: ["TBK 49", "tort", "compensation case", "digital evidence", "digital forensics", "non-pecuniary damages"] author: "DSET Law and Digital Forensics Team"

Turkish Code of Obligations Article 49 and Digital Evidence: Digital Forensics in Tort Compensation

The internet, social media, and messaging platforms are now at the center of daily life. Unfortunately, malicious use is growing just as fast. Someone systematically insulting another person on Twitter, someone else taking over another's Instagram account and damaging their reputation, spreading a deepfake video that shows a person in a place they never were, leaking a company's trade secrets to a competitor. All of these are subjects not only of criminal law but also of the law of obligations. Article 49 of the Turkish Code of Obligations is the basis for a compensation case for torts committed in the digital environment. In this article we address how Article 49 combines with digital evidence and digital forensics, which outputs are decisive in a compensation case, and what the victim should do.

What Is TBK Article 49?

Article 49 of the Turkish Code of Obligations is the fundamental provision on liability arising from tort. In summary, the article says: "Whoever causes harm to another through a faulty and unlawful act is obliged to make good that harm." The second paragraph is also very important: "Even if there is no legal rule prohibiting the harmful act, whoever intentionally causes harm to another through an act contrary to morality is also obliged to make good that harm."

This dual paragraph is critical in the digital world. Because digital acts sometimes do not yet have a clear prohibiting norm, yet their contrariety to morality is indisputable. For example, even though deepfake technology has not yet been prohibited in all its dimensions, showing a person in an image without their consent easily falls within the scope of "contrary to morality" and becomes the subject of compensation under 49/2.

Article 49 looks for four elements:

  1. Act (action or omission)
  2. Unlawfulness or contrariety to morality
  3. Fault (intent or negligence)
  4. Harm (pecuniary or non-pecuniary)
  5. Causal link (between the act and the harm)

In the digital environment, each element must be proven with digital forensics output. This is exactly where the technical report comes in.

Examples of Tort in the Digital Environment

Social Media Defamation and Systematic Mobbing

Carrying out a systematic insult campaign against a person via Twitter, Instagram, or TikTok is a classic Article 49 case. TCK 125 (insult) is the criminal dimension, and TBK 49 is the compensation dimension. The reputational loss the victim suffers, the erosion of trust in their work circle, and psychological wear and tear are items of non-pecuniary damages. Loss of work or loss of customers is an item of pecuniary damages.

Deepfake Imagery and Audio

If a person's face or voice is placed into content without their consent using artificial intelligence, 49/2 (act contrary to morality), TCK 134 (privacy), TCK 226 (obscenity), and KVKK Article 6 (special category data) are applied together. Digital forensics here provides source identification (the person who created or spread the model), spread analysis (how many accounts it reached), and an archive hash (a fixed proof of the content).

Doxxing (Disclosure of Personal Information)

Maliciously spreading someone's home address, phone, or ID number is doxxing. TCK 136 (unlawful provision of data), TBK 49, and KVKK Article 14 operate together. Digital forensics is needed for the IP-level identification of the disclosure source, the spread history, and the correlation of the threatening messages the victim received.

Victimization Following Hacking

Someone's email or social media account is taken over, and messages are sent in their name. The account owner's reputation is damaged and their relationships are strained. TCK 243 (access to an information system), TCK 244 (obstructing a system), and TBK 49 operate together. Digital forensics reports the login logs, the IP, the device used, and the session hashes.

Damaging Commercial Reputation

A competing company damaging another company's reputation with fake reviews, fake complaint platform records, and malicious SEO. TBK 49 plus TBK 58 (attack on personal rights) plus the unfair competition provisions of the TTK are applied together. Digital forensics reports that the fake accounts were opened from the same IP or device, the temporal pattern of the reviews, and the content similarity.

Intellectual Property Theft

The theft and use of a software source code, design file, or customer database. TCK 71 (disclosure of a secret), the provisions of the FSEK, and TBK 49 operate together. Digital forensics performs file hash comparison, traces the reappearance of the stolen code in a similar product, and conducts transfer log analysis.

The Distinction Between Pecuniary and Non-Pecuniary Damages

TBK 49 covers both pecuniary and non-pecuniary damages. Pecuniary damages cover concrete, measurable harm: lost work, customer flight, the cost of psychological treatment received, PR expenditure for reputation restoration, and the IT cost paid to rebuild the system. Non-pecuniary damages, on the other hand, are the counterpart of emotional wear and tear, sorrow, the shame experienced in one's social circle, and psychological trauma. In digital acts, non-pecuniary damages are often a larger item than pecuniary damages, because the impact of the internet is wide and lasting.

HMK 187 and the Documentary Nature of Digital Content

Article 187 of the Code of Civil Procedure draws the rules of the burden of proof and evidence in a compensation case. Article 199 of the HMK provides the definition of a document: "Written or printed text, deeds, drawings, plans, sketches, photographs, films, images, or audio recordings suitable for proving the facts in dispute, as well as data in electronic media and similar information carriers, are deemed documents."

In this sentence the phrase "data in electronic media" is the key. WhatsApp correspondence, a screenshot, an email, a social media post, and a hashed device image all fall within the definition of a document. However, being deemed a document does not on its own mean it carries evidentiary value. What preserves evidentiary value is not the raw data but its integrity. This is where the digital forensics process comes in.

The Role of Digital Forensics in a Compensation Case

In a compensation case there is no investigation conducted by a prosecutor's office. Before the judge, the victim (the plaintiff) must prove their harm and the tort themselves. For this reason a private-sector digital forensics expert opinion is critical.

An effective digital forensics output includes the following:

  1. Device extraction report: Shows that the content taken from the victim's phone or computer was extracted with a forensic tool such as Cellebrite, MSAB XRY, or Magnet AXIOM. The data is stamped with a clear hash (SHA-256).
  2. Chain of custody document: Records step by step when the device was taken, by whom, under what conditions, that it was sealed and packaged, and that it was connected with a write-blocker. It must comply with the ISO/IEC 27037 standard.
  3. Content analysis: The context of the correspondence, sending/receiving time stamps, deleted message recovery, and location information.
  4. Integrity verification: Mathematical proof, via the hash value, that the content was not altered.
  5. Source tracing: Tracing the seemingly anonymous account down to the source as far as possible at the level of the IP, device fingerprint, and account creation email.

How an expert witness report should be structured is decisive in whether this report is accepted in court.

The Combination of Criminal and Compensation Proceedings

TBK 49 is a separate type of case from criminal proceedings, but it is not independent of them. With the offenses under TCK 132-135 (violation of confidentiality of communication, privacy, recording/providing data), the same act can result in both imprisonment and compensation.

In practice there are two paths:

  • Criminal case first, then compensation: If a conviction is obtained in the criminal case, the tort is already deemed "proven" in the compensation case. The plaintiff's burden of proof is eased.
  • Direct compensation case: A compensation case can be filed before any criminal prosecution begins. In this situation the plaintiff must prove the tort themselves. The digital forensics report is of vital importance here.

KVKK Article 14 and the Right to Compensation

Article 14 of the Personal Data Protection Law explicitly states "The right of those whose personal rights are violated to claim compensation under the general provisions is reserved." This provision builds a bridge to TBK 49. If a data controller (a company, a platform, the owner of a database) processes or discloses your personal data unlawfully, they become subject both to KVKK administrative sanctions and to compensation liability via TBK 49. The 72-hour requirement of the KVKK breach notification process is also an important resource for the victim in obtaining evidence.

The Court of Cassation's Approach

When an examination is conducted via the Court of Cassation decision search portal, it is seen that the High Court follows a consistent pattern in cases where TBK 49 combines with digital evidence.

Typical features in the affirmation pattern:

  • The digital forensics report clearly shows the hash chain
  • The evidence was taken under the supervision of a court or prosecutor's office, or for a private-sector report it is documented that it was taken with the opposing party's knowledge
  • The amount of non-pecuniary damages is proportionate to the concrete harm and the victim's social standing
  • The causal link is clearly established in the report

In the reversal or rejection pattern:

  • A screenshot alone, without a hash, was submitted
  • The evidence was obtained by unlawful means (for example, by accessing someone else's phone)
  • The amount of compensation was claimed disproportionately
  • The causal link was weakly established (the claim that the victimization came not directly from that act but from another cause was not met)

This pattern makes it imperative to prepare the opinion correctly before filing the case.

How Is the Amount of Damages Determined?

The amount of damages is at the judge's discretion, but that discretion is not arbitrary. TBK 51 directs the judge, when determining damages, to take into account the characteristics of the event and the gravity of the fault. The factors effective in practice are:

  • The victim's social and professional standing: The reputational loss of a public figure is evaluated differently from that of an ordinary citizen.
  • Breadth of spread: A WhatsApp message sent to a few people differs from a tweet that received a hundred thousand views.
  • Duration: Was the content removed quickly, or did it stay live for months.
  • Degree of intent: A one-off lapse versus a systematic campaign.
  • The perpetrator's financial situation: TBK 52 provides for an equitable reduction in the case of shared fault, but the perpetrator's financial situation is also a criterion for the judge.
  • Prior victimizations: The patterned behavior of the same perpetrator.

For non-pecuniary damages, the figures in Turkish judicial practice vary according to context. Generally a band is observed ranging from a few thousand TL to hundreds of thousands in serious events involving a public figure. Before claiming an amount, examining precedent decisions and setting a realistic band matters for the credibility of the case.

Practical Recommendations (For the Victim)

If you have been the victim of a tort in the digital environment:

  1. Do not just take a screenshot and stop there. A screenshot alone is frequently found insufficient by the Court of Cassation.
  2. Preserve the content. Do not delete the message or post, do not close the account. Avoid additional writes to the device.
  3. Take your device to a digital forensics expert. Have an image taken with a professional write-blocker and the hash stamped.
  4. If there are witnesses, have the witness statements certified by a notary.
  5. Under CMK 67-73, file a criminal complaint with the prosecutor's office and consider pursuing the criminal and compensation proceedings in parallel.
  6. Work with a lawyer. The compensation petition, the amount, and the legal basis must be correctly framed.
  7. Apply to KVKK as well. If there is a data controller, open a parallel path via KVKK Article 14.
  8. Learn the conditions of the admissibility of evidence from platforms like WhatsApp.

Frequently Asked Questions

Is a criminal case required to file a compensation case under TBK 49? No. A compensation case can be filed independently. However, if a conviction is obtained in the criminal case, the compensation case becomes stronger.

Can I receive compensation if the perpetrator of an anonymous account cannot be identified? First, an evidence determination order can be obtained from the criminal judgeship of peace to identify the perpetrator through the platform. If identification is impossible, the case cannot be continued, because the defendant would be uncertain.

How much should I claim for non-pecuniary damages? The gravity of the victimization and precedent decisions are considered. The lawyer recommends a realistic band before filing the case. A very high claim weakens the case.

Is a screenshot enough on its own? No. The court may accept a screenshot, but it is common for it to be found insufficient on its own at the Court of Cassation stage. It must be supported with device extraction and a hash.

What happens if the evidence is on a server abroad? Evidence can be pulled through mutual legal assistance or through the platform's process of responding to legal requests. The process is long. For this reason, local evidence taken from the victim's own device is more practical.

Within how many years must a compensation case be filed? TBK 72 regulates the statute of limitations. A case must be filed within 2 years from the date the harm and the perpetrator are learned, and in any event within 10 years from the date the act was committed.

Am I responsible for posts made in my name after hacking? No. If you prove with a digital forensics report that your account was taken over, you are not responsible for the content. On the contrary, your right to compensation against the perpetrator arises.

A fake review campaign was launched against my company. What should I do? The IP, device fingerprint, and creation date pattern of the fake accounts must be identified. This report provides the technical basis needed for both an interim injunction and a compensation case.

DSET Digital Forensics Legal Support Line

DSET, based at the Hacettepe University Teknokent campus in Ankara, provides expert opinions and technical expert support in tort compensation cases. In compensation cases to be filed under Article 49 of the Turkish Code of Obligations, we build the technical basis of your case with a device extraction, a hash chain, a chain of custody document, and a comprehensive ISO/IEC 27037-compliant opinion report. We are at your side in every kind of digital tort file: social media defamation, deepfake victimization, doxxing, reputational damage following hacking, an attack on commercial reputation, and intellectual property theft. For 360-degree support, including direct coordination with your lawyer, hearing support before the court, and preparation of a KVKK notification, get in touch with us. Phone: +90 536 662 38 09.