> you also have to give the data subjects processes for getting info about what data you have on them Nobody is going to do that for web server logs unless you

> you also have to give the data subjects processes for getting info about what data you have on them Nobody is going to do that for web server logs unless you associate them with user accounts. If it happens once because someone wants to joke around, you can handle it as a one-off. You could also decline unless they can provide a letter from their ISP certifying that the provided IP address is static and has been assigned to them for the requested timeframe, both as a way to verify the legitimacy of the requestor as well as to deter such obviously-malicious requests. > getting it corrected if they want to It's web server logs - those are generated automatically based on incoming request data; there's nothing to "correct" there. > getting it deleted if they want to Up to you how you want to handle this (this depends on whether you need those logs). If you're keeping them for legitimate interest for a certain period of time, you can just refuse, and you can obviously refuse as above until they go through a (admin-intensive) process of actually proving they have owned this IP address for the requested timeframe.