The question businesses ask most often under Law No. 5651 is: "How many months do I have to keep my logs?" The answer is stated plainly in the relevant regulation.
The Legal Retention Period: 6 Months to 2 Years
Under the Regulation on the Principles and Procedures for the Regulation of Publications Made on the Internet:
- Minimum: 6 months (180 days)
- Maximum: 2 years (730 days)
This period applies only to traffic data. Traffic data covers the connection time, duration, source IP, source port, destination IP, destination port and protocol associated with a user's internet access.
Which Period Should I Choose?
The right period depends on the size of your business, its sector and its risk profile:
- Small businesses (hotels, cafés, restaurants): 6 months is sufficient.
- Mid-sized organizations (shopping malls, hospitals, schools): 1 year is recommended.
- Large enterprises (banks, factories, public institutions): 2 years is the preferred choice.
A longer period increases your storage requirements, but it also lets you produce a longer history of data during judicial or administrative audits.
Calculating Log Disk Space
A typical user generates roughly 5–15 MB of logs per day (compressed). For a network with 100 concurrent users, the approximate annual storage requirement is:
- 100 users × 10 MB/day × 365 days ≈ 365 GB/year
- For 2 years of retention, about 730 GB + a 20% margin = 1 TB
What Happens to Logs Once the Retention Period Expires?
Log records that exceed the legal period must be deleted automatically. Under Article 7 of the KVKK (Law No. 6698), personal data whose processing purpose has ended must be deleted, destroyed or anonymized. This process should:
- be automated through a regular backup rotation;
- be documented with deletion/destruction records;
- preserve an electronic signature/timestamp to guarantee log integrity.
Configuring the Retention Period in SignLogger
In the SignLogger interface you can set the retention period per device or globally:
- Go to Settings → Retention Policies in the management panel;
- Choose a period within the range of 180 days minimum and 730 days maximum;
- Enable the automatic deletion schedule;
- Evaluate long-term storage options for your backup archives.
What Exactly Is Traffic Data?
The concept of "traffic data" in the regulation covers the following fields, and the retention period applies to these records:
| Field | Example | Why it matters |
|---|---|---|
| Source IP | 10.5.50.23 | Points to the user on the internal network |
| Source port | 51544 | Distinguishes sessions that share the same IP |
| Destination IP | 142.250.184.4 | The server that was accessed |
| Destination port | 443 | The type of service accessed |
| Protocol | TCP | The type of connection |
| Start/end time | 2026-07-27 14:03:11 | The key to forensic correlation |
Packet content (the page viewed, the message sent) is not traffic data; it does not need to be retained and, from a KVKK standpoint, is not recommended.
Example Scenario: A 2-Year Archive Plan
Consider a 150-room hotel with an average of 400 active Wi-Fi users per day. Say daily raw log generation is around 1.5 GB, or ~150 MB after gzip. A two-year signed archive works out to 150 MB × 730 days ≈ 110 GB. Once you add timestamp documents and a spare backup copy, 250 GB of disk space is enough for years — meaning there is no meaningful cost benefit to shortening the retention period. What matters is that the archive is produced automatically and without interruption; for the process as a whole, see our Law 5651 Logging Obligation guide.
Frequently Asked Questions
Q: Is it legal to retain logs for 5 years?
A: No. The regulation mandates a maximum of 2 years. Under the proportionality principle in Article 5 of the KVKK, longer retention is unlawful.
Q: Can backups of the logs be kept in a different location?
A: Yes. As part of a disaster recovery plan, backups may be kept encrypted at a separate physical location, provided the retention periods and KVKK transfer rules are observed.
Q: Can logs be stored in the cloud (abroad)?
A: For traffic data, and taking into account Article 9 of the KVKK and hosting-provider obligations, transfers abroad should be avoided. Storage within Türkiye is recommended.
Recommended Retention Periods by Sector
| Scenario | Recommended period | Rationale |
|---|---|---|
| Café, restaurant, small business | 1 year | Low volume, standard risk |
| Hotels and accommodation | 2 years | Requests to match against guest records may arrive retroactively |
| Shopping malls, high-density guest networks | 1–2 years | High user count, likelihood of judicial requests |
| Schools, universities, dormitories | 2 years | Seasonal peaks, lengthy investigation processes |
| Corporate offices / business centers | 2 years | Alignment with internal investigations and KVKK processes |
If in doubt, retain close to the upper limit: the cost of storage is far too low to weigh against the risk of being unable to produce logs after the fact.
What Should Be Done When the Period Expires? (Destruction and KVKK)
Traffic records whose retention period has expired must be securely deleted or anonymized in line with the KVKK's data minimization principle. Retaining them indefinitely is a separate form of non-compliance. Logging the destruction process (what was deleted and when) makes your life easier during an audit. For the intersection with the KVKK, see our article on KVKK and Log Management.
Storage Planning: How Much Disk Space Do You Need?
As a rough estimate: on a moderately busy guest network, each user generates 1–5 MB of uncompressed connection logs per day. Compression (gzip) typically reduces the volume to about one tenth. For example, in a hotel with 500 users a day, roughly 100–350 GB is enough for a two-year signed archive. SignLogger compresses archives automatically and raises alerts at disk-usage thresholds; the logging process does not silently stop just because the disk fills up.
Frequently Asked Questions
Is the period counted from the connection or from the record?
The clock starts at the moment the traffic occurs; each day's log is retained for the full legal period based on its own date.
Are backups subject to the same period?
Yes — backup copies must be included in the same retention and destruction policy; otherwise data that should have been deleted lives on in the backups.
How do I preserve log integrity throughout the period?
With daily timestamping and an electronic signature: Signed Logs and Timestamping. For the full process, read our Law 5651 Logging Obligation guide.