Law 5651 log retention is the Turkish requirement for organisations that provide internet access to keep records answering one question: which internal IP address was assigned to which device, and when. They must also prove the records are unaltered. Most hotels, hospitals, schools, cafés and offices offering guest or staff Wi-Fi in Türkiye fall within it.
Why a guest network can make you a regulated provider
A guest SSID in reception, staff phones on the corporate wireless network, an access point for contractors on the factory floor: nobody thinks of this as providing an internet service. Then a prosecutor asks who, at a given date and time, made a connection from your public IP address.
Often the firewall has already overwritten last week's records, or the records show only the public address and nothing about which internal device held which IP. The organisation cannot demonstrate compliance, and innocent staff or guests end up under suspicion.
This guide covers the legal and technical side of keeping those records. Using logs to detect attacks is a different job, explained in our SIEM and log management guide. What follows is a practical framework, not legal advice.
Law 5651 log retention: who keeps what, and for how long
Law No. 5651, Türkiye's law regulating internet publications, sorts online actors by role. A "public use provider" (toplu kullanım sağlayıcı) is anyone who gives people internet access at a particular place for a particular period. The definition does not require a commercial purpose, so in practice it is applied well beyond cafés and hotels: corporate guest and staff networks, hospitals, schools, dormitories and residential complexes.
Article 7 states that all public use providers, commercial or not, must take the measures set by regulation for keeping access records. The law also defines traffic data: the parties' IP addresses, source and destination ports, start and end time of the service, type of service, volume of data transferred and, where available, subscriber identity.
According to the Regulation on Internet Public Use Providers as published in the Official Gazette in 2007, the core technical duty is to record "internal IP allocation logs" electronically. Such a log shows the IP address handed out on the internal network, when its use started and ended, and the MAC address of the device using it. The regulation defines a "commercial" public use provider narrowly: someone offering internet access for a fee in internet lounges and similar places open to the public, essentially internet cafés. These providers must also obtain a permit from the local governor and, using software supplied by the competent authority, record the logs every day together with a value confirming their accuracy, integrity and confidentiality, keeping this data for one year. The authority named in the regulation (the Telecommunications Communication Presidency, TİB) was closed in 2016 and its duties passed to the Information and Communication Technologies Authority (BTK), so follow BTK's current guidance on tools and method.
Regulations can be amended, so confirm your position against the current consolidated text and with local counsel.
| Role | Typical example | Records to keep | Period (legal text) |
|---|---|---|---|
| Commercial public use provider | Internet café, internet lounge or similar public place offering internet access for a fee | Internal IP allocation log plus daily integrity value; also a permit from the local governor | One year under the regulation |
| Public use provider (outside the commercial definition) | Corporate office, factory, hospital, school network; hotels, cafés and shopping centres offering guest Wi-Fi (get legal advice on classification) | Internal IP allocation log, stored electronically | No figure in the regulation; integrity-protected storage for a defined period is advisable |
| Access provider | Internet service providers | Traffic data | Law: not less than six months, not more than two years |
| Hosting provider | Hosting and server rental services | Traffic data for hosted services | Law: not less than one year, not more than two years |
What poor or missing logs cost
The first cost is regulatory. Under Article 7, the local governor (mülki amir) may impose a warning, an administrative fine or a suspension of business for up to three days on commercial public use providers that breach their obligations. For a business in this category, three days of closure can easily hurt more than the fine itself.
The second is evidential. Without records, internal devices cannot be told apart and uninvolved people get drawn in; records whose integrity cannot be shown carry weak evidential value.
The third is security. Verizon's 2026 Data Breach Investigations Report found that exploitation of vulnerabilities was the most common initial access vector in breaches, at 31%. With patchy network records, reconstructing which internal device an attacker moved through becomes largely guesswork.
According to the Turkish Data Protection Authority's 2025 Annual Report, 551 complaints filed in 2025 concerned organisations failing to erase, destroy or anonymise personal data.
That figure is the other side of the coin. Logs kept indefinitely "just in case" fix a 5651 problem by creating a data protection problem.
Law 5651 meets KVKK: retention is processing too
KVKK is Türkiye's Personal Data Protection Law (No. 6698), broadly comparable to the GDPR. An internal IP allocation log holds MAC addresses and timestamps, and if your captive portal also collects a phone or room number, each record links directly to a person. In most cases that makes 5651 logs personal data. The legal basis is the statutory obligation itself, but transparency, access control and retention rules still apply.
In practice that means three things. Show a short privacy notice on the guest portal; the difference between a notice and consent is covered in our privacy notice versus explicit consent article. Add the log category to your data inventory and your retention and disposal policy, and be able to show that expired records are deleted automatically, with the deletion itself logged.
Staff networks need more care. Keeping a 5651 record is not the same as monitoring which sites an employee visits, and the two should run under separate purposes and permissions; see our guide to employee personal data under KVKK. Replacing a shared Wi-Fi password with individual corporate credentials also makes the device-to-person link reliable (say so in your privacy notice), and single sign-on keeps those identities in one place.
How to comply with Law 5651: seven steps to a logging set-up
The first three steps come before buying any hardware.
- Map your networks. List every SSID and who it serves: guests, staff, contractors, production, cameras, IoT. Put guest and corporate traffic on separate VLANs, and check whether production and camera networks reach the internet at all.
- Establish your role. Commercial or not? Do you also host services for others? Your role determines requirements such as the permit, the retention period and the integrity record.
- Choose the log source. Allocation logs usually come from the DHCP server, the firewall or the hotspot (captive portal) system. Where there are several, collect them all centrally.
- Use one time source. Every network device should sync to the same NTP server. A clock two minutes adrift gives the wrong answer to "who had this IP at 14:32?".
- Make integrity provable. Generate a hash of each day's log file and store it separately; add a qualified electronic timestamp where stronger evidence is needed. Only the collection service should have write access to the log store.
- Automate retention and deletion. When the defined period ends, records should be deleted automatically and the deletion recorded. Backups must follow the same period.
- Write the request procedure. Decide who responds to an official request, which query they run and how the output is handed over, and log the query itself. Rehearse it once a year with a sample request.
Test the result against this checklist.
| Check | Good answer | Common gap |
|---|---|---|
| Which device held a given internal IP at a given time last month? | MAC and time range from DHCP or hotspot records within minutes | Records kept for only a few days |
| How do you prove the logs are unaltered? | Daily hash, stored separately with a signature or timestamp | Plain text files on a share anyone can write to |
| Are all device clocks consistent? | Single NTP source, drift monitored | Access points still on factory time |
| Are guest and corporate networks separate? | Separate VLANs and log sources | Guests on the corporate network |
| What happens to expired records? | Automatic deletion with a deletion record | Indefinite archive, old logs left in backups |
| Who can read the logs? | Role-based access, with access logged | Everyone in IT |
The same evidence supports the logging and monitoring controls in ISO 27001 for SMEs. If basic network hygiene is not yet in place, start with our SME cyber security checklist.
Common Law 5651 logging mistakes
The most common mistake is treating 5651 compliance as a hardware purchase. An appliance produces records, but without clock sync, network separation, a retention period and a request procedure those records are of little use. The second is keeping the public IP and skipping the internal mapping, when the internal device is exactly what official requests ask about.
The third is turning 5651 records into an employee monitoring tool: logs kept for a statutory duty and then used in a disciplinary case create a KVKK risk. The fourth is a guest network disconnected from front-desk registration; organisations that manage arrivals with QR code visitor access can limit guest Wi-Fi to the length of the visit.
How Digital Bridge approaches Law 5651 logging
We start with discovery, not hardware. Through our cyber security consultancy we map your topology, SSIDs, DHCP and firewall configuration, existing log sources and retention periods.
We then pilot collection, clock sync, the daily integrity value and a sample query on one guest network, and test together whether you can answer "who had 10.0.20.57 last Tuesday at 14:32?" in minutes. Records from mixed-vendor network equipment, hotspot software or building systems are brought into one store through our system integration services.
If the archive is to live in the cloud, immutable storage and access logging go into the plan from day one as part of our cloud migration and infrastructure consultancy. Privacy notices, inventory entries and retention rules are handled with our data protection compliance team, following the same path as our KVKK compliance roadmap.
Where the logs should also feed incident detection, we connect the same pipeline to a SIEM so you can build a timeline within the 72-hour breach notification window. More guides are collected on our Cyber Security & Compliance hub.
Next step
Ask three questions this week. How many wireless networks do your premises run, and who is each one for? Could you find which device held an internal IP a month ago? Is the deletion date written down?
If any answer is unclear, contact us and we will map your networks and log sources with you. Discovery ends with a prioritised list of gaps.