Ideally: 1. Use logging SaaS that takes GDPR seriously (e.g. Sumo Logic where I work). 2. Avoid logging sensitive data (e.g. log id, not the address), use joi

Ideally: 1. Use logging SaaS that takes GDPR seriously (e.g. Sumo Logic where I work). 2. Avoid logging sensitive data (e.g. log id, not the address), use joins when you can reconstruct them. 3. Keep logs with reasonable retention. 4. Use logs for debugging and operational aspects, don't use those data for marketing, profiling as it is causes a lot of pain (e.g. right to forget). GDPR is generally vague what it actually means and there are a lot of interpretations. E.g. can I log IP of my visitors without consent. Possible answers: 1. No you can't. Never. 2. Yes, do whatever. 3. Yes, If you use it for security or system troubleshooting. No, if you use it for marketing, sales, etc. The majority of interpretations, lean towards 3, but some ppl claim 1.