How about storing data for spam or DDoS mitigation? You need that data for those filters. But it's in the scope of GDPR. Do you give the spammers that data unde

How about storing data for spam or DDoS mitigation? You need that data for those filters. But it's in the scope of GDPR. Do you give the spammers that data under SAR requirements, so they can improve? Or do you keep lawyers to justify denials of each request (some of them bogus?) We have done a lot of due diligence on GDRP and we don't "track or monetize" everything. Have you?