3 ms·
You can keep such logs under article 6.1.f if the retention period is 30 days or less (causing self-fulfillment of article 17) or indefinitely if you remove/ano
by formerly_proven 5y ago
You can keep such logs under article 6.1.f if the retention period is 30 days or less (causing self-fulfillment of article 17) or indefinitely if you remove/anonymize PII from them. Of course article 17.3 gives you an exemption for various purposes, e.g. if you had a breach you don't need to delete the logs from that period while investigating it.
- shadowgovt 5y agoI fail to see how a 30-day or fewer retention policy impinges on article 17 one way or the other, nor do I see how article 6.1 gives any protection on the topic of the default Apache HTTP access logs (which include IP addresses).