What is Law 5651 and why does it exist?
Formally titled "Law on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications", it entered into force in 2007. Its purpose, in short: when a crime is committed over the internet, the question "who was using this connection at that time?" must be answerable.
To make that answer possible, the law and its regulations impose record-keeping (logging) obligations on the parties that provide, host and offer internet access.
Which roles are in scope?
1. Access providers
Operators providing internet access to their users — ISPs and WISPs. They must retain access records (which subscriber held which IP and when — including NAT port blocks where applicable).
2. Mass-use providers
The broadest and most overlooked group: anyone offering internet access to people at a given place and time. In practice:
- Hotels, guesthouses, resorts (guest Wi-Fi)
- Cafés, restaurants, shopping malls
- Hospitals, schools, dormitories, libraries
- Every company that opens a guest network in its office
- Municipal public Wi-Fi services
Commercial mass-use providers (e.g. internet cafés) carry additional licensing and content-filtering obligations.
3. Hosting providers
Parties hosting content. Their traffic-record retention obligations are defined in the 1–2 year range by regulation.
Which records, how long?
| Role | Records to keep | Retention |
|---|---|---|
| Access provider | Subscriber–IP mapping, session start/end, NAT port blocks | At least 2 years (regulations define 6 months–2 years per record type) |
| Mass-use provider | Internal IP assignment logs: which device/user had which internal IP, when | Per regulation — 2-year retention is common practice |
| Hosting provider | Traffic records | 1–2 years |
The form of the records matters as much as their content: the regulation requires safeguarding their accuracy, integrity and confidentiality, provable via timestamps.
The timestamp requirement
A text file sitting on disk is not legally presumed "unaltered" — it can be edited at any moment. That is why the regulation requires records to be sealed with qualified timestamps as defined by E-Signature Law No. 5070, issued by an Electronic Certificate Service Provider authorized by the regulator (BTK).
The technical details are in our timestamping guide; the short version: a SHA-256 digest of the daily log file is signed by the provider together with the current time. From then on, if even one character changes, verification fails.
The cost of non-compliance
- Administrative fines: The law prescribes role-based fines for violations; amounts are revalued annually.
- Liability shifting to you: The real risk is bigger than the fine. If a crime is committed through your network and you cannot produce records, you cannot point to the perpetrator — the investigation focuses on you as the subscriber/business owner.
- Loss of evidential value: Records that exist but are unstamped invite the objection that they "may have been fabricated later".
Field observation: The two most frequent findings in audits and lawful requests: (1) a device silently stopped logging months ago, (2) records are unstamped. Both are fully preventable with automated monitoring and stamping.
A compliant setup in 4 steps
- Inventory List every device granting internet access: firewalls, hotspot controllers, DHCP servers, every NAT box.
- Centralize Forward all of these sources to a central syslog server; leave no logs on devices.
- Stamp and retain Automatically seal daily files with SHA-256 + RFC 3161; retain at least 2 years.
- Monitor and drill Alert on silent sources; run a "who had this IP on this date?" drill at least yearly.
The SYSLOG platform automates all four steps: browse the solutions or test yourself against the audit checklist on our compliance page.
Quick answers
Only my employees use the internet at my office; am I in scope? Providing internet to staff is also considered mass use; you are expected to keep internal IP assignment records.
Isn't the router's own log enough? No. It is wiped by circular buffers, unstamped, and its integrity cannot be proven.
Can I keep records in the cloud? Yes — the storage location is flexible as long as integrity, confidentiality and availability are ensured. Cloud SYSLOG keeps records in Türkiye, redundant and stamped.