Law No. 5651 Logging: Legal Obligations and Compliance Guide

5651 logging takes its name from Law No. 5651 of 2007, “On Regulating Publications on the Internet and Combating Crimes Committed by Means of Such Publications.” In everyday use, it refers to keeping records that show which device connected with which IP address, and during which time interval, at a place where internet access is provided. Article 7 of the Law places obligations on collective use providers in this respect; the details are governed by the Regulation on Internet Collective Use Providers.

The records must be of a kind that can be presented to the competent authorities in the event of an incident or suspected offense, and it must be possible to show that they have not been altered since. That is why this is not merely a network setting; it is a process made up of record collection, retention and integrity verification.

The expression “internal IP distribution log,” common in older guides, is a term from the earlier 2007 regulation. That regulation was repealed by article 14 of the 2017 regulation. The current regulation uses the term “access records.”

Under article 2 of the Law, a collective use provider is a person who provides people with the means to use the internet at a specific place and for a specific period. The scope of the obligation has two tiers:

• All collective use providers

  Whether or not they operate commercially, they are obliged to take the measures set out in the Regulation on blocking access to content that constitutes an offense and on keeping access records of use (Law art. 7, paragraph 2).

• Commercial collective use providers

  In addition, they must obtain a permit from the local civil authority (paragraph 1) and apply the additional measures in the Regulation for protecting the family and children, preventing crime and identifying offenders (paragraph 3).

In practice, the following businesses may fall within the definition: hotels offering wireless networks to their guests, shopping malls, cafes and restaurants; hospitals with patient and visitor networks; schools; factories and holding company offices that offer visitor, dealer or customer networks; public buildings. This is an example list, not a definitive ruling: a corporate network used only by employees may be assessed differently. Decide whether your organization falls within the scope by looking at who uses your network and for what purpose.

Article 3 of the Regulation defines “access records” as the following information:

Providers offering internet in public areas are also expected to set up a system that can identify users; as an example of this, the Regulation mentions SMS verification (art. 4, paragraph 1-c). This makes it possible to match the IP and MAC record to the person who connected.

In practice, this information does not come from a single device. NAT records are generated on the firewall, the IP-MAC mapping on the DHCP server, and user verification at the hotspot or captive portal layer. A sound 5651 infrastructure combines these sources using timestamps and turns them into a single chain of records.

Two years. The Regulation requires access records to be retained in electronic form for two years, both for all collective use providers (art. 4, paragraph 1-b) and for commercial ones (art. 5, paragraph 1-d). Commercial providers record the value that verifies the accuracy, integrity and confidentiality of the records every day and retain that for two years as well (art. 5, paragraph 1-e).

The period starts on the day the record is generated, and the record must remain readable and accessible throughout. In practice, the most common problems are these: old records being overwritten in rotation once the disk fills up, the archive not being migrated when a device is replaced, and access to the records being lost when a license expires. Test your retention plan against each of these three risks separately.

NextLog5651 retains records in data centers in Türkiye for two years and backs them up automatically.

The Regulation does not set a timestamp or an electronic signature as a separate requirement. What it requires of commercial providers is that the value verifying the accuracy and integrity of the records be recorded and retained every day (art. 5, paragraph 1-e). For this verification to be reliable, three steps are followed in practice:

1. 1 · DAILY FILE

   That day's access records are collected into a single file.

2. 2 · SHA-256 DIGEST

   A digest value is generated from the file; if even a single character in the file changes, the digest changes.

3. 3 · TIMESTAMP

   The digest is sealed with a trusted time source, documenting that the record existed at that moment.

The TÜBİTAK Kamu SM timestamp is a common implementation of this third step. Although it is not mandatory, it makes things easier whenever you want to show that a record has not been altered since; it is the most practical way to defend the reliability of a record during an inspection.

Law art. 7/4 authorizes the local civil authority, depending on the seriousness of the violation, to apply one of the following sanctions against commercial collective use providers that breach these obligations:

• Warning
• Administrative fine

  In the text of the Law, from 1,000 to 15,000 Turkish lira.

• Suspension of activity

  Commercial activity for up to three days.

Non-commercial collective use providers are also obliged to keep access records (art. 7, paragraph 2); however, the fine and suspension sanctions are not written for them.

Articles 11 and 12 of the Regulation elaborate on enforcement: sanctions are applied in graduated steps, and in setting a penalty, aggravating factors such as the continuation of the violation, repeat offenses and economic gain, and mitigating factors such as a record of past compliance are taken into account. Premises operating commercially without a permit may be closed ex officio by official report and sealing (art. 7, paragraph 1).

The amounts given here are the figures in the text of the Law; verify current practice on mevzuat.gov.tr and with the civil authority you are subject to. Beyond the sanction, missing or altered records leave the organization unable to present evidence in an incident investigation; that is often the real cost.

Records can be kept in your own environment or on a service provider's cloud infrastructure. Either can deliver the result the Regulation asks for; the difference lies in who carries the burden.

For an organization with a single location, low record volume and a strong IT team, a local solution can be reasonable. For organizations with multiple branches, growing record volumes, or that do not want to manage the two-year archive and daily integrity verification on their own, a cloud-based solution markedly reduces the maintenance burden and the risk of loss.

One caution: using a cloud service does not transfer the obligation; responsibility stays with the business. Settle the retention period, integrity verification, data location and access rights with the provider in the contract.