Summary: Which logs, for how long and where? Combining Law 5651 access records, KVKK access logs and Law 7545 preparation in a single log architecture.

In Turkey, logging at many companies grows out of three separate needs: Law 5651 for guest and staff internet access, KVKK (the Turkish data protection law) for tracking access to personal data, and security, to show what happened during an incident. Cybersecurity Law No. 7545 has put this last need on a legal footing as well.

Solving the three separately raises costs and makes it harder to correlate logs during an incident. A single architecture is more efficient.

1. Classify logs by purpose

  • Access logs (Law 5651): internal IP assignment, NAT and internet access records. See our Law 5651 guide for details.
  • Personal data access logs (KVKK): database, file server and application access; who looked at which record.
  • Security logs: firewall, VPN, authentication, EDR, email security.

2. Write down retention periods

Records under Law 5651 follow the periods set in its regulations. KVKK does not set a fixed period; you define it by purpose in your data retention and destruction policy. For security logs, until the secondary regulations under Law 7545 are clear, choose a period long enough to investigate an incident retrospectively and document the reasoning.

3. Prove integrity

For a log to serve as evidence, you need to show it has not been altered. Timestamps, hashes and append-only (WORM) storage are used for this.

4. Keep logs away from their source

Logs stored on a server can be deleted by an attacker who takes over that server. Forward logs in real time to a central server or SIEM.

5. Protect personal data inside logs

Logs contain personal data too: IP addresses, usernames, MAC addresses. Restrict access to the log system, log that access as well and delete expired records according to your destruction policy.

6. Synchronise time

A few minutes of clock difference between devices makes it very hard to build an incident timeline. Point all devices to the same NTP source.

Practical tip

Once the log architecture is in place, run a test: measure how many minutes it takes to answer "which user had this IP address last Tuesday at 14:05?".

Let's bring it into one architecture

At Bilgi Teknoloji we plan Law 5651 logging, central monitoring and logging and KVKK technical compliance in a single log infrastructure.

Would your logs help in an incident?

Let's review your current logging setup together.

Request a call