Law 5651 logging refers to the obligation for businesses that provide internet access to collect the traffic records (logs) on their networks, seal those records with a timestamp and digital signature, and retain them unaltered for the legally required period. This duty, imposed on businesses by Law No. 5651, is often noticed only when an audit or a judicial request comes knocking — and by that point it is impossible to produce logs retroactively. In this guide we explain who the Law 5651 logging obligation covers, which logs need to be collected, and how to build a compliant system.
What Is Law 5651 Logging?
Law No. 5651, the "Law on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications," divides the parties that provide internet access into two groups: access providers (ISPs) and mass-use providers — that is, businesses that open internet access to their customers, guests, or staff. You can find the full text of the law at mevzuat.gov.tr.
For mass-use providers, the Law 5651 logging obligation consists of three core components:
- Log collection: Recording who accessed which external address, at what time, and from which internal IP across the network.
- Integrity assurance: Sealing the collected logs with a timestamp and a digital signature, so that it can be proven the records were not altered after the fact.
- Retention: Securely archiving the signed logs for the legally required period (in practice, 1–2 years).
Simply collecting logs is not enough: records without a timestamp and signature may not qualify as evidence in a legal dispute. For details, see our article on Signed Logs and Timestamping.
Who Does the Law 5651 Logging Obligation Cover?
Every business that provides internet access commercially or to the public falls within scope. The most common examples are:
| Sector | Typical scenario |
|---|---|
| Hotels and hospitality | Guest Wi-Fi, per-room access, PMS-integrated login |
| Cafés and restaurants | Customer hotspot, SMS verification |
| Malls and retail chains | High-density guest network, multi-branch centralized logging |
| Hospitals and clinics | Patient/visitor Wi-Fi, compliance alongside KVKK |
| Schools, universities, and dormitories | Campus network, student verification |
| Offices and business centers | Staff and visitor internet, corporate firewall logs |
| Municipalities and public spaces | Free public Wi-Fi hotspots |
An important detail: scope is not limited to guest Wi-Fi. Any workplace that provides internet access to its staff is also considered a mass-use provider — meaning even an office with no guest network at all must collect Law 5651-compliant logs from its firewall. For detailed information on the scope of the law and the obligations by business type, see our guide What Is Law No. 5651?
Which Logs Must Be Collected?
At a minimum, Law 5651 logging is expected to capture the following records:
- NAT / connection logs: Which internal IP connected to which external IP and port, and at what date and time. The vast majority of judicial requests ask for exactly this correlation.
- DHCP logs: Which internal IP was assigned to which device (MAC address).
- Hotspot / captive portal records: If you run a guest network, which session a user opened after identity or phone verification.
- DNS and web access logs: Which domain names a device accessed (depending on the firewall's capability).
For a breakdown of which log types should be collected from which devices, see our article Which Logs Must We Keep for Law 5651? Retention periods vary by sector and scenario; our guide Law 5651 Log Retention Period includes a detailed table.
How Is Law 5651 Logging Done?
1. Collect logs on a central server
Your firewalls, routers, switches, and access points send their logs to a central log server using the syslog protocol. Nearly every brand — including FortiGate, Sophos, SonicWall, WatchGuard, Zyxel, Mikrotik, and Palo Alto — supports syslog forwarding. The only thing to do on the device side is to define the IP address of the Law 5651 logging server as the log destination.
2. Apply timestamping and digital signatures
The collected logs must be stamped daily with a TÜBİTAK-approved timestamp and signed with a digital signature. In SignLogger, accredited certificate-authority signing is performed through integration with the TÜBİTAK Public Certification Authority (Kamu SM): during the integration step, each customer defines their own Kamu SM username and password in SignLogger and purchases the timestamp credit from Kamu SM in their own name. When no timestamp credit is available, daily logs are still signed using the server's own certificate and timestamp. This step proves that the records "existed on that date and were not altered afterward" — it is the heart of Law 5651 compliance.
3. Set up a captive portal for your guest network
If you offer open Wi-Fi to guests, you need a captive portal that verifies users via SMS, a form, or sponsor approval, so that log records are matched to a real identity. For an example setup, see our FortiGate RADIUS and Guest Captive Portal Guide.
4. Automate archiving and backups
Signed logs should be compressed and archived, backed up regularly, and preserved until the retention period expires. Logging stopping because a disk filled up is one of the most common causes of non-compliance in practice; storage monitoring and automatic cleanup policies eliminate this risk.
Law 5651 Logging: Appliance or Software?
The hardware boxes marketed as "Law 5651 logging appliances" and the software solutions installed on a virtual server do the same job. Hardware boxes require extra physical space and involve warranty and spare-parts processes; with the virtual appliance approach, a ready-made image is imported into your existing Hyper-V or VMware infrastructure and goes live in about 30 minutes. SignLogger uses this second approach: you download the ready-to-run virtual machine package and run it on your own server, so your data stays within your own infrastructure.
What Are the Penalties for Not Logging?
Mass-use providers that fail to fulfill their obligations under Law 5651 may face administrative fines; moreover, if a crime is committed over your network and the perpetrator cannot be identified, liability falls on the business. For penalty amounts and scenarios, see our article on Law 5651 Penalties. Regardless of any audit, the real risk is this: when law enforcement requests logs retroactively after a judicial incident, those logs cannot be produced if they were never collected.
Law 5651 Logging with SignLogger
SignLogger brings the entire Law 5651 logging process together on a single platform:
- Brand-independent syslog collection — FortiGate, Sophos, SonicWall, WatchGuard, Zyxel, Mikrotik, Palo Alto, and more
- Automatic daily signing with TÜBİTAK-approved timestamping and digital signatures
- Captive portal with SMS, form, sponsor, and LDAP verification (guest Wi-Fi)
- Automatic archiving, backups, and disk monitoring
- Reporting and advanced search that produce results within minutes during an audit
You can review all capabilities on the features page and request a demo for a 30-day free trial. From installation to audit, Turkish-language engineering support is at your side.
Frequently Asked Questions
Does the Law 5651 logging obligation also apply to small businesses?
Yes. The law does not distinguish by business size; a single-location café and a chain with hundreds of branches are equally obligated to collect logs if they provide internet access.
Are the modem's own logs sufficient?
No. The records kept by home-grade modems/routers are deleted within a short time and contain no timestamp or digital signature, so they do not provide Law 5651 compliance.
Should logs be stored in the cloud or on-premises?
The law imposes no location requirement; what matters is integrity and accessibility. For organizations that prefer to keep their data on their own server, SignLogger runs on-premises.