Blog · LOGVAULT · 5651

Turkey's Law 5651 Logging Rules: Who Must Keep Access Logs

Published: Updated: 16 min read

Written and technically reviewed by Önder Önderoğlu, Network & Cybersecurity Engineer

If your company operates in Turkey and provides internet access, Law No. 5651 requires access logs. Who is covered, what to record, how long, how to store.

This is an English adaptation of our Turkish article on Law 5651 logging, written for IT and compliance leads of foreign-owned companies operating in Turkey. The official texts are in Turkish and are linked below; English terms are followed by the Turkish original in parentheses. This page is for information only and is not legal advice.

Short answer

  • If your company operates in Turkey (Türkiye) and gives staff or visitors internet access — an office LAN, guest Wi-Fi, a hotel, a store — Law No. 5651 applies to you. You are a collective-use provider (toplu kullanım sağlayıcı) in the law's terms, regardless of headquarters location, sector or headcount.
  • "5651 logging" means keeping internet access records (which device, with which IP/MAC address, connected where and when) under Law No. 5651 and its regulations, protecting their integrity, and retaining them for a set period.
  • Collective-use providers must retain access records for two years (Regulation on Internet Collective-Use Providers, art. 4/1-b). The law sets a 6-month to 2-year range for access providers (ISPs) and a 1- to 2-year range for hosting providers (Law arts. 6/1-b and 5/3).
  • Records are kept electronically with their accuracy, integrity and confidentiality protected. Commercial collective-use providers (internet cafés and the like) must generate and keep a daily integrity value; in practice this means hashing the log blocks and sealing them with a timestamp (zaman damgası) issued under Law No. 5070.
  • These records are not only a compliance archive: the same data is one of the most valuable inputs to security monitoring (SIEM). Feeding it into security operations rather than locking it in a separate box uses one dataset for two purposes.

What is Law No. 5651?

Law No. 5651 — in full, the "Law on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications" (İnternet Ortamında Yapılan Yayınların Düzenlenmesi ve Bu Yayınlar Yoluyla İşlenen Suçlarla Mücadele Edilmesi Hakkında Kanun) — was adopted on 4 May 2007 and published in the Official Gazette (Resmî Gazete) No. 26530 of 23 May 2007. It defines the obligations of content providers, hosting providers, access providers and collective-use providers, and regulates access blocking and content removal.

The part known as "logging" is the obligation of these actors to keep traffic data (trafik bilgisi) / access records (erişim kaydı). The current text of the law defines traffic data as "the IP addresses of the parties, source and destination port information, start and end time of the service provided, type of service used, amount of data transferred and, where available, subscriber identity information" (art. 2/1-j, as amended in 2014). In other words, the subject is which connection was made, when, from whom to whom — not what anyone read.

Two regulations give the law's framework its practical shape:

  • Regulation on Internet Collective-Use Providers (İnternet Toplu Kullanım Sağlayıcıları Hakkında Yönetmelik; Official Gazette 11.04.2017, No. 30035) — obligations of anyone providing internet access at offices, hotels, cafés and similar places. This is the main subject of this article.
  • Regulation on the Procedures and Principles for the Regulation of Publications on the Internet (İnternet Ortamında Yapılan Yayınların Düzenlenmesine Dair Usul ve Esaslar Hakkında Yönetmelik; Official Gazette 30.11.2007, No. 26716) — traffic-data obligations of access and hosting providers.

Who must comply?

The law defines four actors; the logging obligation essentially falls on three of them.

Actor Who? (Law art. 2) Logging obligation
Access provider (erişim sağlayıcı) Natural or legal persons providing users with access to the internet — in practice, internet service providers (ISPs) Retain traffic data for a period, fixed by regulation, of between 6 months and 2 years; ensure its accuracy, integrity and confidentiality (Law art. 6/1-b)
Hosting provider (yer sağlayıcı) Natural or legal persons providing or operating systems that host services and content — hosting and data-centre providers Retain traffic data for a period, fixed by regulation, of between 1 and 2 years (Law art. 5/3)
Collective-use provider (toplu kullanım sağlayıcı) Anyone enabling people to use the internet at a given place for a given time: company offices, hotels, cafés, shopping malls, schools, hospitals, dormitories, public bodies Keep access records electronically on their own systems and retain them for two years; filter access to sites with criminal content; identify users in publicly accessible areas (SMS or similar) (Regulation art. 4)
Content provider (içerik sağlayıcı) Natural or legal persons producing, modifying or providing information or data on the internet Responsible for the content it provides; no separate traffic-record retention duty in the law

The point most often misunderstood — especially by group IT teams reading Turkish requirements from abroad — is this: a company does not need to be an ISP to be in scope. If you provide a wired network to employees or Wi-Fi to guests at a Turkish site, you are a collective-use provider. Law art. 7/2 obliges all internet collective-use providers, whether commercial or not, to take the measures set by regulation on blocking access to criminal content and keeping access records.

Article 5 of the regulation adds further duties for commercial providers, who offer internet access for a fee at a place open to the public. The typical example is an internet café. Such providers must obtain a permit from the local civil authority (mülki idare amiri), use a fixed IP address and report any change within fifteen days. They must also keep the filtering system active and record, every day, the value that confirms the accuracy, integrity and confidentiality of the records, keeping it for two years. For commercial collective-use providers, sanctions are decided by the local civil authority (mahalli mülki amir). Under Law art. 7/4, it can issue a warning, an administrative fine (idari para cezası) or a suspension of commercial activity of up to three days. The choice depends on the severity of the breach. The text of the law sets the fine at one thousand to fifteen thousand Turkish lira, with amounts updated by annual revaluation. Regulation art. 11 applies these in sequence: a written warning on the first breach, closure for up to three days if it continues, and a fine on repetition.

What must be recorded?

The regulation defines an "access record" (erişim kaydı) in art. 3/1-e; the earlier 2007 regulation called it "internal IP distribution logs" (iç IP dağıtım logları). It covers the internal IP address the provider assigns, the start and end time of use, the MAC address of the device using it and the destination IP address. Where a single public IP is shared among several users through ports, it also covers the public IP address and port allocated to the user. In practice, this usually maps to these sources:

  • DHCP records — which MAC address received which internal IP, at what time.
  • Firewall / NAT session records — which internal IP went out at what time to which external IP and port, via which source port. Because many devices share one public IP, a record without the internal-IP-to-translated-source-port mapping is useless. Firewalls (such as FortiGate, Sophos, Check Point) already produce this in their traffic (session) logs; the job is to collect it without loss and in a tamper-evident form.
  • Authentication records — hotspot/captive portal (SMS verification on guest Wi-Fi), RADIUS/802.1X or Active Directory logon records: the link that ties an IP to a user.
  • Time source — every device must use the same NTP source. Records from two devices with different clocks cannot be joined.

These records are access metadata; the content of pages visited, messages or files is not within this scope, and retaining it requires a separate legal assessment.

How long must records be kept?

Who Period Basis
Collective-use provider (commercial or not) 2 years Regulation on Internet Collective-Use Providers, arts. 4/1-b and 5/1-d
Access provider (ISP) 6 months – 2 years in the law; the exact period is set at regulation level Law No. 5651, art. 6/1-b
Hosting provider 1 – 2 years in the law Law No. 5651, art. 5/3

Two notes. The Council of State (Danıştay) annulled the clause of the Procedures and Principles Regulation that set the access provider's retention period. The 2007 "six months" wording for hosting providers also falls short of the one-year minimum the law introduced in 2014. For these two actors, this article relies on the ranges in the law itself. The period that concerns the vast majority of companies — the collective-use provider period — is clear: two years.

The clock runs from the moment a record is created, so the retention system must be able to delete expired records automatically and demonstrably. Keeping records beyond their period is itself a compliance problem (see the KVKK section below).

How must records be stored?

The common yardstick across the legislation is three words: accuracy, integrity, confidentiality. Their technical equivalents:

  1. Electronically, off the originating device. Records are not left on the local disk of the device that produces them (firewall, hotspot); they are transferred to a separate log server or a service built for this purpose. Local disks overwrite the oldest record when full; the two-year window closes unnoticed.
  2. Tamper evidence and verifiability. A hash of each block of records is taken and sealed with a timestamp (zaman damgası), so that it can be proven whether a record was altered afterwards. For commercial collective-use providers, producing this integrity value daily is an explicit duty (Regulation art. 5/1-e); the Procedures and Principles Regulation likewise requires hosting providers to "keep file integrity values together with a timestamp" (art. 7/1-c). For other businesses this is also the most common reading of the "ensure integrity" criterion. Timestamps are obtained from certificate service providers operating under the Electronic Signature Law No. 5070 (Elektronik İmza Kanunu).
  3. Encrypted transport and encrypted storage. Records contain personal data; encrypt them both in transit and at rest.
  4. Access control and audit trail. Who looked at the records, and when, must itself be logged. Access outside a lawful request is kept restricted.
  5. Retrievability. You must be able to produce the record for a given date, time and IP within a reasonable time. An archive that was backed up but cannot be opened is, legally, no record at all; test restores periodically.
  6. Redundancy. Not one disk or one server: at least two copies, preferably at different physical locations.

Compliance archive or security data?

The common practice treats 5651 as a separate box: a hotspot or log appliance is placed at the site, records accumulate there, and the box is opened only when a lawful request arrives. That meets the obligation, but leaves valuable data unused.

A 5651 record also answers the questions security operations ask:

  • "Which external address did this internal IP connect to at 03:10 last night?" — connections to known malicious IPs/domains, suspected command-and-control traffic.
  • "Whose is this MAC address, which user was logged on?" — finding the source device and person after an incident.
  • "Which device moved an unusual volume of data out of hours?" — a data-exfiltration indicator.
  • "From which device did the malware spread to which?" — tracing lateral movement inside the network.

Collect once, use twice: one copy of the records goes to the tamper-evident 5651 archive, and the same data feeds the SIEM correlation rules. See our article on what a SIEM is (in Turkish). You avoid the cost of double collection and the risk of two inconsistent copies. What you spend on 5651 then pays off in daily security monitoring, not only when a lawful request arrives.

The precondition is a lightweight collection architecture. You do not need to ship an appliance to every site. Forward the logs your existing firewall already produces to a virtual collector through the device's own (native) log forwarding (how to collect firewall logs centrally, in Turkish). Then connect the DHCP and authentication sources to the same collector.

Relationship with KVKK (Turkey's data protection law)

IP addresses, MAC addresses and usernames are personal data (kişisel veri). 5651 records therefore also fall under Turkey's Personal Data Protection Law No. 6698 (Kişisel Verilerin Korunması Kanunu, KVKK). KVKK is a 2016 law — amended in 2024, notably on cross-border transfers — generally described as modelled on the EU's 1995 Data Protection Directive; it shares the GDPR's basic vocabulary but is not identical to it (see our article on KVKK technical measures for logs and access). Three consequences:

  • The legal basis for processing is "compliance with a legal obligation of the data controller (veri sorumlusu)"; even so, the privacy notice (aydınlatma metni) given to employees and visitors must mention this processing.
  • Records whose retention period has expired must be deleted, destroyed or anonymised; two years is not a minimum but a maximum tied to the purpose of processing, and it belongs in the organisation's retention and destruction policy (saklama ve imha politikası).
  • If you keep the records with a service provider, that provider is a data processor (veri işleyen); the contract must state the roles, the security measures and where the data is held. Keeping the data inside Turkey simplifies matters, because it does not by itself trigger the conditions for cross-border transfer (yurt dışına aktarım); remote access from abroad should be assessed the same way — a point worth checking early if your group's SOC or log platform is abroad.

Common mistakes

  • Records live on the firewall's local disk. The disk rotates when full; you cannot go back two years.
  • NAT (translated source port) mapping is not kept. A record of "which internal IP went to which site" alone does not answer the question that arrives in a lawful request: "who was this external IP:port at this time".
  • No DHCP-to-MAC mapping. If you do not know which device held the IP, the record cannot be tied to a person.
  • Clocks are not synchronised. Records from devices that do not use NTP cannot be joined.
  • Anonymous guest Wi-Fi. User identification by SMS or similar in publicly accessible areas is an explicit requirement of the regulation.
  • Unsigned archive. The record exists, but you cannot prove it was not altered.
  • Untested restore. There is a backup; it does not open.
  • Expired records are not deleted. Looks fine on the 5651 side; on the KVKK side it is a retention-and-destruction breach.
  • The 5651 archive is disconnected from security monitoring. The same data is collected twice or never analysed; at incident time you find "the log exists but nobody was looking".

Checklist

  1. Put in writing which sources (DHCP, firewall/NAT, hotspot, RADIUS/AD) you collect records from.
  2. Verify that all sources use the same NTP server.
  3. Transfer records off the device into an encrypted store.
  4. Seal record blocks with a daily hash plus timestamp.
  5. Define the retention period as two years, with automatic and logged destruction.
  6. Every three months, run a drill: produce the record for a random date, time and IP.
  7. Cover 5651 records in your privacy notice and retention-and-destruction policy.
  8. If the service is outsourced, confirm the data-processor contract and the location of the data.
  9. Make sure the same record stream also feeds security monitoring (SIEM); do not leave it locked in a separate box.

How voosec does it

On the voosec platform, 5651 is not a separate appliance but one output of the same collection pipeline:

  • No appliance at the site. Only one virtual server (the voosec proxy) is installed on your network; no additional hardware is shipped.
  • Direct collection from the firewall. Your firewall's own log forwarding (syslog) — on firewalls (such as FortiGate, Sophos, Check Point) — is pointed at the proxy; DHCP, hotspot and directory sources are added to the same proxy. No agent is needed on the firewall; records arrive through the device's own forwarding.
  • LogVault · 5651. Records are signed and timestamped, sealed so that their integrity can be verified; they travel over an encrypted channel and are stored on infrastructure in Türkiye. Scope is defined per device.
  • Integrated with SIEM. The same stream feeds correlation rules; the 5651 archive and security alerts sit in the same console. You can watch the alerts yourself, or our 24/7 SOC team can.
  • Flexible term. You can start with a 12-month term; a discount applies to a 24-month commitment. Pricing — a fixed plan fee plus a monthly per-device fee — is shown instantly in the calculator; prices are in USD, invoiced in TRY at the daily rate.

Frequently asked questions

We are a small Turkish office of a foreign group; only our own employees use the internet. Are we in scope?

Yes. The "collective-use provider" definition covers anyone who enables people to use the internet at a given place; there is no threshold by headcount, sector or ownership.

If we switch off guest Wi-Fi, does the obligation go away?

The user-identification requirement for the guest network goes away; the duty to keep access records for the employee network continues.

We already have a firewall; do we also need to buy a 5651 appliance?

Not in the voosec approach. The traffic logs your firewall produces, including post-NAT address/port information, reach the virtual collector through the device's own log forwarding (syslog). Signed retention and the SIEM feed both use that stream. What you need is correctly configured log forwarding, not another box.

Can we keep the records in the cloud, or on our group's log platform abroad?

The legislation says "record electronically on their own systems"; in practice this is also done through a contracted service provider. Whoever hosts the records, the 5651 obligation — including producing a record on a lawful request within a reasonable time — stays with the collective-use provider in Turkey. Under KVKK, the data-processor contract and the country where the data is held become decisive; storing the records abroad, or making them accessible from abroad, brings KVKK's cross-border transfer conditions into play, so check that before pointing Turkish logs at a platform outside the country.

Sources

The official texts are in Turkish (mevzuat.gov.tr, the government's consolidated legislation portal). English translations in this article are unofficial.

This article is for general information and does not constitute legal advice. Article numbers and periods reflect the consolidated texts on mevzuat.gov.tr on the date of publication; verify the current text there. The official texts are in Turkish; where this page and the official text differ, the official text prevails.

← All articles