What is Law No. 5651? Often called Turkey’s “logging law,” Law No. 5651 frames how internet-access records must be kept—and preserved with evidentiary integrity—to help combat online crime. Short answer: a company that lets employees, guests, or customers use its internet is often treated as a mass-use provider; “firewall logging is on” is not enough without DHCP/NAT logs, correct time, timestamps, and retention. Compliance = right records + integrity + retention + access procedure.
This guide is written for:
- SMB and enterprise leaders who provide internet access
- IT/network teams expected to implement 5651 technically
- Hotels, cafés, plazas, and offices running guest Wi-Fi
- Decision makers placing 5651 next to KVKK / ISO 27001
Quick Summary
- 5651 does not mean “log every click”; it produces evidence for who used internet access, when, and via which IP/port.
- Office staff Wi-Fi or customer Wi-Fi usually puts a company in scope.
- Minimum technical pack: DHCP + NAT/PAT logs, NTP, timestamping, central retention.
- Retention must be written in policy; practice often references a
2-yeararchive. - 5651 ≠ KVKK—purpose and data sets differ: 5651 vs KVKK.
- Deeper technical frame: What Is 5651 Logging?.
Table of Contents
- What Is 5651? (In Company Language)
- Is Your Company Obligated?
- Which Records Must Be Kept?
- Timestamps, NTP, and Retention
- 5651 vs KVKK vs ISO 27001
- A 5-Step Roadmap for Companies
- Most Common Mistakes
- Related Articles
- Checklist
- Next Step with LeonX
- Frequently Asked Questions
- Sources
Image: Wikimedia Commons - Cisco Sourcefire 3D 7120 (example enterprise security/log-source appliance form factor).
What Is 5651? (In Company Language)
The official title of Law No. 5651 is long; for a company leader the core is this: an organization that shares internet access must keep access records in a form that can serve as legal evidence. The goal is not a personal-data inventory—it is answering “which internal user/device used that public IP at that time?”
Short definition:
Law No. 5651 is the legal framework requiring companies that provide internet access to generate access logs, protect their integrity (typically via timestamps), and retain them for a defined period.
Technical depth: 5651 Logging. Network design pitfalls: 5651 Network Architecture Mistakes.
Is Your Company Obligated?
Most companies fall into scope via one of these scenarios:
| Scenario | Typical outcome |
|---|---|
| Staff office internet / Wi-Fi | High mass-use-provider risk |
| Guest / plaza Wi-Fi | Same; plan identity/Captive Portal |
| Free customer Wi-Fi (café, hotel, mall) | Obligation + operational process |
| Only servers/DMZ, no user internet | Scope may be narrower; still get legal review |
“We are a small company” is not an exemption. Shared lines and mass use drive the factual analysis. Treat this guide as a technical-operational frame; confirm legal interpretation with counsel and the statute text.
Which Records Must Be Kept?
Practical minimum set on the company side:
- DHCP / IP assignment logs — which MAC got which private IP, and when
- NAT/PAT logs — private IP + source port ↔ public IP + port mapping
- Time — NTP-synced clocks and a consistent timezone
- Identity binding (where possible) — Captive Portal, 802.1X, AD user mapping
A “destination URL list” or a thin firewall traffic summary often fails to prove the internal user. NAT port mapping plus the DHCP chain are essential. Architecture: SIEM, Syslog and 5651. Firewall example: FortiGate Logging.
Pro Tip: In single-public-IP offices, “who did it?” almost always comes down to NAT source port + DHCP lease. Without those two logs, the evidence chain breaks.
Timestamps, NTP, and Retention
| Component | Why it matters | Practical note |
|---|---|---|
| NTP | Clock drift kills evidence | Target offset <1–2 s |
| Timestamping | Integrity / evidentiary value | “Existed and unchanged” claim |
| Central archive | Disk overwrite risk | SIEM / log server / legal archive |
| Retention | Legal + corporate policy | Common practice frame: 2 years |
| Access rights | Not everyone may delete logs | Separate admins, audit trail |
Integrity: Log Integrity under 5651. Archiving: 5651 Archiving and Retention.
5651 vs KVKK vs ISO 27001
| Framework | What it wants from a company | Confusion risk |
|---|---|---|
| 5651 | Internet-access evidence | Assuming “firewall log = 5651” |
| KVKK | Personal-data processing & security | Dumping every log into the KVKK inventory |
| ISO 27001 | ISMS monitoring/evidence | Treating a 5651 archive as SoA review |
All three can feed one SIEM; purpose, retention, and access policies must still be written separately. Integration: KVKK and ISO 27001 Integration, 5651 vs KVKK.
A 5-Step Roadmap for Companies
- Map scope — who gets internet? (staff, guests, customers)
- List log sources — firewall NAT, DHCP, Wi-Fi controller, Captive Portal
- Centralize collection — syslog/SIEM; do not trust on-box disk alone
- Time + timestamp + retention — NTP, signing,
2-year(or policy) archive - Write the process — who accesses, who deletes, how legal requests are answered (e.g.
1–3 business daysSLA)
To avoid network mistakes, read 5651 Network Architecture Mistakes.
Most Common Mistakes
- Saying “we are not an ISP, so 5651 does not apply”
- Enabling only firewall traffic logs and skipping DHCP/NAT
- Opening guest Wi-Fi with no logging
- Archiving for years with wrong NTP/timezone
- Treating untimestamped logs as courtroom evidence
- Merging 5651 and KVKK into one procedure
Related Articles
- What Is 5651 Logging, and for Whom Is It Mandatory?
- Difference Between 5651 and KVKK
- Why Log Integrity Matters under 5651
- Archiving and Retention in 5651 Projects
- Mistakes When Designing 5651-Compliant Networks
- SIEM, Syslog and 5651 Architecture
- How to Configure FortiGate Logging
- FortiGate Logging ISO 27001 Requirements
Checklist
- Groups using internet (staff/guest/customer) are inventoried.
- DHCP + NAT/PAT logs land in a central archive.
- NTP is correct; timezone is consistent.
- Timestamp / integrity method is defined.
- Retention is written (common frame:
2 years). - Log-delete rights are separated.
- Guest Wi-Fi has an identity/Captive Portal plan.
- Legal-request response procedure is written.
- 5651 and KVKK policies are kept separate.
Next Step with LeonX
For companies, 5651 is not “one logging appliance”—it is network + records + retention + process. Under Business Management Services, LeonX surfaces gaps via Cybersecurity Assessment; on the technical side we build auditable logging through SIEM and Security Event Management Integration and Network Security, Firewall and IPS/IDS. Start at Contact.
Frequently Asked Questions
What is 5651, and why do companies care?
It is the law framing evidentiary internet-access logging. Companies that give staff or guests internet usually fall under obligation.
Are small offices in scope?
Often yes—shared lines and mass use are factual tests. “Small company” is not an automatic exemption; clarify scope legally and technically.
Are firewall logs alone enough?
Usually no. Proving the internal user needs DHCP and NAT/PAT mapping: 5651 Logging.
How long should logs be kept?
Write it in policy; practice often references 2 years. Do not rely on disk overwrite: Archiving.
Does 5651 replace KVKK?
No. Different purposes; design them together, do not substitute one for the other: 5651 vs KVKK.
