> E.g. you also have to give the data subjects processes for getting info about what data you have on them, getting it corrected if they want to, getting it del

> E.g. you also have to give the data subjects processes for getting info about what data you have on them, getting it corrected if they want to, getting it deleted if they want to. A Policy note is standard for most sites. An email address or form where users can request their data isn't possible for web logs storing IP alone. So long as the analysis window for the logs is shorter than the max response time to data requests, you can always autorespond at the end of the response time window saying "Thanks for your request on date D. We have no data stored for you from date D and earlier". Which would be true since the logs are then already flushed out. The paperwork if there is zero real per-user data, zero third parties/subcontractors etc. will be pretty minimal (thankfully). This is of course assuming 2 things: 1) that you can do all your log analysis in a very short window and 2) that you can do it in house and won't send it to a third party.