A cafe, hotel or office offering Wi-Fi to guests may face log retention obligations under Turkey's Law No. 5651. We outline who is affected, which records are kept, integrity through hashing and time stamping, and a practical setup built on a firewall and a log server.
If you offer internet access in a cafe, hotel, hospital waiting room or on your office guest network, you may have heard that this service has a legal side. Turkey's Law No. 5651, the law regulating publications on the internet and combating crimes committed through them, together with its implementing regulations, places obligations on certain businesses to retain traffic and access records.
In this article we look at 5651 log retention from a technical perspective: who may be affected, which records are kept, how their integrity is protected and how a practical setup can be built.
Important note: this article is for general information only and is not legal advice. Legislation can change over time. We recommend confirming your business's obligations and the current regulations with legal counsel.
Who Does Law No. 5651 Affect?
The law and its regulations define different internet actors under different headings. For log retention, the headings most relevant to businesses are:
- Mass use providers: those who offer people internet access at a given place for a given time. Cafes, restaurants, hotels, dormitories, hospitals, shopping centres and businesses running public hotspots offering Wi-Fi to guests are generally considered in this category. Companies offering internet access to employees and visitors may also fall within scope depending on their situation.
- Access providers: service providers that give users internet access.
- Hosting providers: individuals and organisations that provide or operate systems hosting websites and content.
Each heading carries different obligations. For mass use providers, for example, there may be additional obligations such as content filtering alongside log retention. Which heading applies to your business depends on the nature of the service you provide.
Which Records Are Kept?
Log retention under 5651 does not mean recording the content of the pages users visit. The aim is to be able to determine, when required, which device or user a given IP address belonged to at a given time. For mass use providers, the following information generally matters:
- Internal IP allocation records: which internal IP address the DHCP server assigned to which device (MAC address), and for what time period.
- Access and traffic records: which external IP and port an internal IP used after address translation (NAT), to which destination and at what time.
- User identification: how users are authenticated on hotspot systems. Many businesses use SMS verification or ID-based login; confirm with legal counsel whether this is mandatory for you.
Because these records may qualify as personal data, KVKK, Turkey's data protection law, must also be considered. Privacy notices, access permissions and where the data is stored all matter.
Retention Period
The relevant regulations set a range for retaining traffic data of not less than one year and not more than two years. Which record must be kept for how long can depend on your business's scope and the current provisions of the regulations. We therefore recommend setting your retention period based on current legislation and together with legal counsel.
Technically, what matters is that the chosen period is enforced automatically by the system: records are kept complete for that period and deleted in a planned way when it expires.
Integrity: Time Stamping and Hashing
Storing logs alone is not enough. In a dispute or an official request, you need to show that the records were not altered later. Two core techniques are used:
- Hash: a unique fingerprint generated from the content of a log file. If even one character changes, the hash changes completely, so the file's integrity can be verified.
- Time stamp: a process that proves, through a trusted source, that the hash existed at a given moment. An electronic time stamp is obtained from an authorised time stamping service provider.
In practice, log files are closed at regular intervals (for example daily), hashed and time stamped. It is worth confirming which stamping method is sufficient for you in light of current regulations.
Accurate, synchronised clocks on every device are also critical. If the firewall, DHCP server and log server show different times, matching records becomes difficult. Pointing all devices to a reliable NTP source is a basic step.
A Practical Setup: From Firewall to Archive
From a small business to a multi-site hotel chain, a 5651 logging setup usually has these layers:
1. Devices That Generate Records
The source of records is usually the firewall or hotspot gateway. Most business firewalls can send NAT translations and session information out via syslog. DHCP records come from the firewall or a separate DHCP server. Keeping the guest network on a separate VLAN from the corporate network matters for both security and log separation.
2. Log Server
Records from devices are collected on a central log server. It organises them into files, closes them at set intervals, calculates hashes and handles time stamping. The log server itself must be protected: access should be restricted and its management interface should not be exposed to the internet.
3. Long-Term Archive
Logs accumulated over one or two years take up serious space, especially on busy networks. Keeping them on the log server's local disk is risky for both capacity and security. If the disk fails or the server is hit by ransomware, records you are legally required to keep can be lost.
A good practice is therefore to send a copy of closed, stamped log files to immutable object storage that supports object lock. A file protected by object lock cannot be deleted or modified for the set period, even with an administrator account. This strengthens integrity and helps technically guarantee the retention period.
4. Monitoring and Checks
Log flow can stop silently: a syslog setting may reset after an update, a disk may fill up, or time stamping may fail. Log flow, stamping and archive uploads therefore need regular monitoring. Retrieving and verifying a random day's records from the archive once a month shows the system really works.
Recommendations for Multi-Site Businesses
For hotel chains, restaurant groups or retailers with several branches, running a separate log server at every site is costly and hard to manage. A more sustainable model:
- Each site's firewall sends its records over an encrypted connection (for example an IPsec VPN) to the central log server.
- Records are kept in separate folders or tagged per site, so the right site's records can be found quickly when a request arrives.
- All sites use the same configuration template, so a new branch joins the system in minutes.
- If the device supports a local buffer or queue, it is enabled so records are not lost when the connection drops.
A central setup also simplifies monitoring. You can see from a single screen which site has stopped sending logs and fix it the same day.
Common Mistakes
- Keeping only a few days of logs on the firewall's own disk
- Forgetting to collect DHCP records; NAT records alone may not identify the device
- Not synchronising device clocks
- Storing logs without hashing and time stamping
- Keeping the log archive on a disk on the same network, reachable with the same administrator password
- Never deleting records after the retention period; this can create a separate risk under KVKK
Frequently Asked Questions
Does 5651 affect me if I only provide internet to my employees?
That depends on the nature of the internet service and who it is offered to. If you run a network open to guests, you are more likely to be in scope. Consult legal counsel for a definitive assessment; technically, logging the corporate network is good security practice anyway.
How long do I need to keep logs?
The regulations set a range between one and two years. Set your exact period based on current legislation together with legal counsel.
Can I store logs in the cloud?
Technically yes, and it is often safer than a local disk. Because records may contain personal data, keeping them in Turkey simplifies matters under KVKK. Using immutable storage also strengthens integrity.
Which firewall is suitable for 5651?
No specific brand is required. What matters is that the device can export NAT and session records via syslog, DHCP records can be collected and time synchronisation is configured correctly.
5651 Logging Infrastructure with CloudRUX
Log retention is more than ticking a box: you need to be sure records are collected completely, stamped and kept safely for years. At CloudRUX, our Turkish-speaking engineers build and monitor the setup with you, from firewall logging configuration to the log server. For the immutable archive you can use our S3 object storage in data centres in Turkey; 1 TB costs 49 USD per month (VAT excluded). Explore our security and compliance services, or get in touch for a setup that fits your environment.