Allowing the court to decide makes it possible to interpret degrees of wrongness and malice of intent. IP addresses may be personal data if you have a database

Allowing the court to decide makes it possible to interpret degrees of wrongness and malice of intent. IP addresses may be personal data if you have a database containing personal data (like a web form) and the IP address. Don’t have that database, or only make it accessible to your firm and processors to verify data integrity/protect against fraud: no problem. Dropping the IP column from that table after a month is probably easy enough and good enough. The GDPR also doesn’t mandate encryption. It says you’re responsible if you get hacked and could’ve prevented it. Applying an IT security standard (eg ISO) is just one (probably easily) defensible way to do it. Not getting hacked is another. Your consultants should fully understand your business and data flows: individual things taken in isolation are a “grey area” but looked through the lens of your whole company, actions and intent, versus value to the subject themselves (instead of just your customers) is what the European courts will do if they decide to give your company attention; they will not nit.