GDPR doesn't ask not to store it but it's a matter if how it's used once you do. For example it should be kept only as long as its needed, for example for the c

GDPR doesn't ask not to store it but it's a matter if how it's used once you do. For example it should be kept only as long as its needed, for example for the case of abuse if you are required to investigate abuse cases up to 3 months in the past you don't need to keep the IP assesses longer than that. If you do then you breach gdpr. In addition if the user requests his information deleted then unless that user is under investigation at the time you got 30 days to delete his data and forget he ever existed.