> If you're not collecting data, then all of this is irrelevant. You just say "I'm not collecting data". There's no nuance here. How do you prove you are not c

> If you're not collecting data, then all of this is irrelevant. You just say "I'm not collecting data". There's no nuance here. How do you prove you are not collecting data? If your use default configs of Apache, or Nginx, your access.log is probably infringing GDPR. It’s impossible to prove you’re not collecting this without an extensive audit.