How long must guest Wi-Fi records be kept?

You can find six different answers to this question online. You can find contradictions within a single site's own articles. The regulation in force gives one figure.

The answer: two years

The İnternet Toplu Kullanım Sağlayıcıları Hakkında Yönetmelik (Official Gazette 11/4/2017, No. 30035) sets the retention period for access records at two years. The period appears identically in two articles:

• Article 4/1-b — for all mass use providers
• Article 5/1-d — for commercial mass use providers

Both use the same wording:

"…kaydetmek ve iki yıl süre ile saklamak" (…to record and store for two years)

So there is no difference in retention between the two groups.

Why do different figures circulate?

Three sources of confusion:

1. Provider categories get mixed up. Other retention periods do exist in the 5651 framework, but they belong to other categories. Hosting providers, for instance, have a shorter period in a different regulation. Those do not apply to a business offering guest Wi-Fi.

2. The repealed 2007 regulation. Articles based on the old text, repealed in 2017, are still circulating.

3. Confusion with CCTV. Article 9/1-ğ of the same regulation sets 90 days for security camera footage. That is a separate period with nothing to do with access records.

What does the two years cover?

What you keep is the access record, not browsing history. Under the article 3 definition, an access record includes:

• The internal IP address
• Connection start and end times
• The MAC address
• The destination IP address
• The real IP address and port behind NAT

Web pages visited, search terms and message contents are not covered, and are not asked for.

How much space does two years take?

This is the most common practical question. A rough calculation.

One access record line takes roughly 150–250 bytes uncompressed. Depending on daily sessions and connections per device:

Daily unique guests	Approx. records per day	Raw size over 2 years	Compressed
50	50–150 MB	35–110 GB	4–12 GB
200	200–600 MB	145–440 GB	15–45 GB
500	0.5–1.5 GB	365–1,100 GB	40–120 GB

The ranges are wide because usage patterns dominate; video streaming produces many connections.

The practical conclusion: with compression, a few tens of gigabytes suffice for a mid-sized business. But disk usage must be monitored — logging that stops has the same result as never logging at all.

What happens when the period ends?

The regulation requires two years of retention; it does not forbid keeping records longer. Under KVKK, however, the data minimisation principle means data whose purpose has ended is expected to be deleted.

A practical approach: set up automatic deletion of records older than two years. You avoid holding needless data and you avoid disk problems.

Checklist

• Are records kept without gaps? (Days when the device was off leave holes.)
• Is disk usage monitored?
• Is there a second copy? (A device failure should not take two years of data with it.)
• Are records older than two years deleted?
• Can records be exported when asked for?

The last item is the one most often skipped. Keeping records is not enough; you have to be able to produce them in a readable form on request.

---

This article is for information only and is not legal advice. Consult a lawyer about your own situation. Quotations are taken from the legislation as it stood on the date of publication.