German courts have ruled that IP addresses are personal data. EU courts so far agree. The timestamp is irrelevant. The GDPR makes anything that can be potentia

German courts have ruled that IP addresses are personal data. EU courts so far agree. The timestamp is irrelevant. The GDPR makes anything that can be potentially traced back to a person personal data, it's a much wider definition than PII. It also means that constructing data sets may lead to personal data being generated out of non-personal data. So even if you only store IPs without timestamp, if you stored timestamps elsewhere and you could reconstruct the IP of the user, you're up for grabs.