Law No. 5070: what a timestamp means
The term "timestamp" is not defined in 5651 — it's defined in Electronic Signature Law No. 5070. This page explains the official definition of a timestamp, what an electronic certificate service provider (e.g. Kamu SM) is, and how this relates to the integrity value required for access records under 5651.
Law No.: 5070 · Date of enactment: 15/1/2004 · Official Gazette: 23/1/2004, issue 25355.
Article 1 — Purpose
Madde 1- Bu Kanunun amacı, elektronik imzanın hukukî ve teknik yönleri ile kullanımına ilişkin esasları düzenlemektir.
"Article 1- The purpose of this Law is to regulate the legal and technical aspects of the electronic signature and the principles relating to its use."
Electronic Signature Law No. 5070, Art. 1 — unofficial translation — mevzuat.gov.tr
What this means: This law regulates the legal validity of the electronic signature and related concepts (certificate, timestamp); it's a general-purpose law, entirely separate from 5651.
Article 3/h — Definition of a timestamp
Madde 3- Bu Kanunda geçen; […] h) Zaman damgası: Bir elektronik verinin, üretildiği, değiştirildiği, gönderildiği, alındığı ve / veya kaydedildiği zamanın tespit edilmesi amacıyla, elektronik sertifika hizmet sağlayıcısı tarafından elektronik imzayla doğrulanan kaydı, ifade eder.
"Article 3- As used in this Law; […] h) Timestamp: Means a record, verified by electronic signature by an electronic certificate service provider, for the purpose of establishing the time at which an electronic data item was produced, altered, sent, received, and/or recorded."
Electronic Signature Law No. 5070, Art. 3/h — unofficial translation — mevzuat.gov.tr
What this means: A timestamp is a record that proves, through an independent and trusted third party (an electronic certificate service provider), that a piece of data existed at a specific moment. The key point: this definition explains what a timestamp is; neither 5651 nor the related Regulation uses the word "timestamp" as a mandatory term for public use providers (see the relationship section below).
Article 8 — Electronic certificate service provider
Madde 8- Elektronik sertifika hizmet sağlayıcısı, elektronik sertifika, zaman damgası ve elektronik imzalarla ilgili hizmetleri sağlayan kamu kurum ve kuruluşları ile gerçek veya özel hukuk tüzel kişileridir. Elektronik sertifika hizmet sağlayıcısı, Kuruma yapacağı bildirimden iki ay sonra faaliyete geçer.
"Article 8- An electronic certificate service provider is a public institution or organization, or a real person or private-law legal entity, that provides services related to electronic certificates, timestamps, and electronic signatures. An electronic certificate service provider shall commence operations two months after its notification to the Authority."
Electronic Signature Law No. 5070, Art. 8 — unofficial translation — mevzuat.gov.tr
What this means: A timestamp service isn't provided by just any arbitrary server; it's provided by an electronic certificate service provider that satisfies specific conditions and notifies the Authority. One of the organizations providing this service in Turkey is Kamu Sertifikasyon Merkezi (Kamu SM, TÜBİTAK).
Relationship to Regulation Art. 5/1-e
Subparagraph (e) of Art. 5/1 of the Regulation on Internet Public Use Providers requires, only for commercial providers, a value confirming the "accuracy, integrity, and confidentiality" of access records to be logged daily and retained for two years (see Regulation, Art. 5). The Regulation doesn't specify how this value is to be technically produced, and it doesn't use the word "timestamp."
That said, the definition of a timestamp under Law No. 5070 — an independent third party verifying by electronic signature that a record existed at a specific moment — is exactly the technical counterpart of the "accuracy, integrity" concepts. For this reason, obtaining a qualified timestamp is a practice that strengthens the integrity value the Regulation requires and increases reliability; but there is no universal and separate "timestamp requirement" in the text of the legislation. Statements such as "logs are invalid without a timestamp" or "a timestamp is a legal requirement" are not supported by the text of the legislation.
izgate's daily timestamp implementation
izgate first chains each archive segment to the previous one with SHA-256, then signs it with an Ed25519 key specific to the installation. For these signed segments, a qualified timestamp is obtained once a day via Kamu SM, through İzHost's central service (the digests of all that day's not-yet-stamped segments are combined into a Merkle root, and that root is stamped); an automatic integrity check runs every night. Together, these three layers strongly support that a record has not been altered afterward and existed on the stated date.
This implementation is offered as an additional safeguard to strengthen evidentiary value — it is not presented as a universal requirement the legislation imposes on all public use providers.
Frequently asked questions
Do my logs become invalid without a timestamp?
No. The legislation doesn't impose a separate and mandatory "timestamp" requirement on all public use providers. Only for commercial providers, Regulation Art. 5/1-e requires a value confirming the accuracy/integrity/confidentiality of records to be logged daily; a timestamp is a method that strengthens this value, not the only mandatory method.
Who issues the timestamp?
An electronic certificate service provider authorized under Art. 8 of Law No. 5070. One of the organizations providing this service in Turkey is Kamu Sertifikasyon Merkezi (Kamu SM). izgate obtains a qualified timestamp through this service once a day.
Why does izgate get a daily timestamp instead of an hourly one?
Archive segments close hourly and are immediately protected with a SHA-256 chain and an Ed25519 signature; this secures integrity the moment the segment is created. The qualified timestamp added on top, once a day, combines all of that day's not-yet-stamped segments into a single Merkle root and stamps it, providing an additional, independent proof of time.
This page is for information only; for the current text of the legislation, refer to the official source (mevzuat.gov.tr).
Making your network Law No. 5651 compliant is a one-day job.
Configure izgate Cloud based on your number of firewall devices and storage needs; no setup, get started in minutes. Call us with any questions.