Logging IP addresses under GDPR: pseudonymous, personal data, and what's allowed?
An IP address is personal data under GDPR. Security logs often need to retain them for weeks or months. How do you reconcile that with data minimisation principles?
Under GDPR, an IP address is considered personal data. Security logs that capture IP addresses fall within the scope of data processing.
\n\nPermitted legal bases
\n- \n
- Legitimate interest: security, fraud prevention, troubleshooting. Most commonly used. \n
- Legal obligation: where specific legislation applies (e.g. financial supervision). \n
- Consent: rarely required for security logs. \n
Retention periods
\n- \n
- Web access logs: 30 days as standard, up to 90 for forensic purposes. \n
- Auth logs (login attempts): 90 days – 1 year. \n
- Firewall logs: 30–90 days. \n
- Audit logs for compliance: 3 years (ISO-required). \n
Longer retention = stronger justification needed in your processing register, plus a risk analysis explaining why it is necessary.
\n\nPseudonymisation
\nCan you anonymise the last octet (192.168.1.x → 192.168.1.0/24)? Sufficient for analytics. Usually not for security — you need to be able to correlate a specific IP address.
\n\nData subject rights
\nSomeone asks "what logs do you hold on me?" — you must be able to search by their IP address as well as their account ID. Document how you do this in your system.
\n\nSee also: GDPR pillar, retention periods.
Volledige gids: Cumplimiento GDPR para pymes: el mínimo práctico
Dit artikel is onderdeel van onze uitgebreide AVG & privacy-gids. Lees de pillar voor het complete plaatje.
Lees de pillar →