We did had some of the talks with lawyer about security (in particular logs) and general consensus was that as long as they are stored explicitly for that purpo

We did had some of the talks with lawyer about security (in particular logs) and general consensus was that as long as they are stored explicitly for that purpose and only that purpose it isn't a problem, they just have to be properly secured. Logs like that fall under 6.1.b-f, basically "making sure malicious actor can't fuck with site" overrides needing to get permission to process that. Again, if they are used ONLY for that and are stored securely. Same reason why security footage (which also falls under GDPR) doesn't need consent, only information visible onto property entrance informing who is processing that info.