> I don't think gdpr has any teeth for information that isn't actually stored. But if it 1. isn't stored && 2 there is a good reason (e g. be able to block at

> I don't think gdpr has any teeth for information that isn't actually stored. But if it 1. isn't stored && 2 there is a good reason (e g. be able to block attacks) && 3. it isn't abused for any other illegal reason then I think they are fine, no extra consent needed to store the IP address temporarily. But then the law has already been followed. Edit: also I wouldn't expect anyone outside of IT to care if something is "stored" in RAM or on disk. Kn this case that might be a good thing.