The 5651 log retention period: why two years?

Under the Regulation on Internet Public Use Providers, the retention period for access records is two years. This period is the same for every public use provider, commercial or not; phrases such as "at least one year" or "1-2 years" are not consistent with the legislative text. The period is explicitly written as "two years" in Articles 4/1-b and 5/1-d.

Short answer: two years

The only number that appears in the legislation is "two years." This means the access record must remain accessible and intact, with its integrity preserved, in your own system for at least two years from the day it was recorded electronically. This matters in practice because a request or investigation usually arrives long after the event; if your record has been deleted before two years have passed, you can no longer show who carried out the transaction at that moment.

Article texts

For general public use providers, Regulation Article 4/1-b states:

"Erişim kayıtlarını elektronik ortamda kendi sistemlerine kaydetmek ve iki yıl süre ile saklamak."

"To record access records in electronic form in their own systems and retain them for a period of two years."

Regulation on Internet Public Use Providers, Art. 4/1-b — unofficial translation — mevzuat.gov.tr

For commercial-purpose internet public use providers (internet cafes and similar venues), the same period is repeated in Article 5/1-d, and the integrity value must also be retained for the same period:

"d) Erişim kayıtlarını elektronik ortamda kendi sistemlerine kaydetmek ve iki yıl süre ile saklamak, e) (d) bendi gereğince kaydedilen bilgileri ve bu bilgilerin doğruluğunu, bütünlüğünü ve gizliliğini teyit eden değeri kendi sistemlerine günlük olarak kaydetmek ve bu verileri iki yıl süre ile saklamak,"

"d) To record access records in electronic form in their own systems and retain them for a period of two years, e) To record daily, in their own systems, the information recorded pursuant to clause (d) and the value confirming the accuracy, integrity and confidentiality of that information, and to retain that data for a period of two years,"

Regulation on Internet Public Use Providers, Art. 5/1-d, e — unofficial translation — mevzuat.gov.tr

In other words, the period stays the same (two years) for commercial-purpose providers — the only addition is the daily recording of the integrity value. This extra obligation concerns only businesses similar to internet cafes that sell internet for a fee; for non-commercial providers like hotels, cafes or offices, the period is the same, but the legislation does not separately mandate the daily recording of an integrity value. You can find the distinction between the two categories in the What Is a Public Use Provider? guide.

Where two years comes from

One point worth noting: Law No. 5651 itself sets separate retention ranges for access providers (Art. 6/1-b) and hosting providers (Art. 5/3), and those ranges are variable, to be set within the regulation. For public use providers, however, the Regulation does not write the period as a range — it writes it as a fixed number: "two years." This is the period that this guide and izgate's default settings are based on.

Three different actors are subject to three different time logics, and it's important not to confuse them:

• Access provider (your internet service provider): retains traffic information for a period to be determined by regulation, not less than six months and not more than two years (Law Art. 6/1-b).
• Hosting provider (the operator of the servers hosting content): retains traffic information for a period to be determined by regulation, not less than one year and not more than two years (Law Art. 5/3).
• Public use provider (your business): retains access records for a fixed, direct period of two years (Regulation Art. 4/1-b, 5/1-d).

Regardless of which of these three actors you are, the only figure that matters for your business is the one that applies to public use providers — not a range, but a fixed period of two years.

What the period covers

The two-year period covers the access records defined in Regulation Article 3/1-e: internal IP address, start/end time of use, MAC address, destination IP address, and the NAT (real) IP and port information. You can find each of these fields explained in detail in the What Are Access Records? guide. For commercial-purpose providers, the integrity value is also retained for the same period. What matters is that the period doesn't just answer "does a record exist," but also "has this record remained complete and unchanged since the day it was created."

Retention setting in izgate

The legislation gives you a minimum period, but it doesn't tell you how to implement it technically. In izgate, the retention period isn't a fixed legislative constraint — it's a setting you define from the panel. The live record (the database used for fast search) and the signed archive are kept at the same time but on separate disks; the retention period is defined in days for both. For 5651, the default and recommended period is two years, and you can extend that period at any time.

• Live + archive, in parallelEach record is written simultaneously to the fast-search database and to the signed archive; if one is affected, the other is preserved.
• Separate disksLive data and the archive are kept on different physical disks; one filling up does not affect the other.
• Capacity warningWhen disk usage reaches certain thresholds, a warning is raised in the panel and through your notification channels.

What happens when a disk fills up

The most practical risk around retention is that data is actually lost before the period the legislation requires has elapsed — most often because disk space runs out. In many setups, the live database and the archive are kept on the same disk; when that disk runs out of space, the system either stops recording or silently deletes the oldest records. Either outcome effectively breaks the two-year retention target.

izgate reduces this risk in two ways: first, because live and archive data are kept on different disks, one filling up does not affect the other; second, when a disk fills up, records are not silently deleted — a timely warning is raised through your panel and notification channels (email, Telegram, webhook), and your existing records stay in place until you expand your disk space. You can also see the Disk Management feature page, which covers this topic in detail.

Common misstatements

• "Logs are kept for 1 year." Incorrect; the Regulation explicitly says two years for public use providers.
• "The period varies between 1 and 2 years." For public use providers, the period is not a range — it is a fixed two years. (The Law does set different ranges for access and hosting providers, but that does not change your obligation as a public use provider.)
• "A record whose retention period has expired must be deleted immediately." The legislation sets a minimum period; your business retaining records longer is not prohibited.

Frequently asked questions

This page is for information only; for the current text of the legislation, refer to the official source (mevzuat.gov.tr).