Yes, it is. You need to put into your privacy policy what you log (and yes, IP addresses are personal data) and how long your retention policy is. However, it's

Yes, it is. You need to put into your privacy policy what you log (and yes, IP addresses are personal data) and how long your retention policy is. However, it's pretty easy to argue that IP addresses in logs are required (for a reasonable time, like a week) to provide the service. Might want to talk to a data protection officer before you go around swinging terms like FUD.