GDPR and Log Retention: Can You Keep IP Addresses Forever?
Security teams want logs forever. Privacy law says you can’t keep personal data longer than you need it.
Both are right, and the way to reconcile them is to be deliberate about what you keep, and in what form.
This is general information, not legal advice. Talk to your DPO or counsel about your specific situation.
Are IP addresses personal data?
Often, yes. In Breyer v Germany (C-582/14, 2016), the Court of Justice of the EU held that even a dynamic IP address can be personal data when the website operator has legal means to identify the person behind it, for example with the ISP’s help in the case of an attack.
Web server and CDN logs are full of IP addresses, usually alongside timestamps, URLs, and user agents. Treat them as personal data unless you have good reason not to.
The storage limitation principle
GDPR Article 5(1)(e) says personal data must be kept “no longer than is necessary for the purposes for which the personal data are processed.”
That doesn’t ban long retention. It means you need to:
- Name the purpose (for example, security incident investigation)
- Justify the duration for that purpose
- Delete or anonymize when the purpose no longer needs the data
Security is a legitimate purpose
Recital 49 of the GDPR says processing personal data “to the extent strictly necessary and proportionate for the purposes of ensuring network and information security” is a legitimate interest. It explicitly mentions preventing unauthorized access and stopping denial-of-service attacks.
So keeping IP logs to detect and investigate attacks has a solid legal basis. The questions are how long is “strictly necessary”, and what detail you need.
The tension, in one line: You often discover incidents weeks or months late, which argues for longer retention. The storage limitation principle argues for shorter. A written, reasoned policy is how you resolve it.
A tiered approach
Not all log data carries the same privacy risk. Retention can differ by form:
| Data | Privacy risk | Typical approach |
|---|---|---|
| Raw request logs (IP + URL + user agent + time) | High | Short: weeks to months, for security only |
| Security events for blocked or flagged requests | Medium | Longer: often 12 months, tied to incident response |
| Aggregated analytics (requests per day, by country, by path) | Low | Long-term; typically no individual can be identified |
| Truncated or hashed IPs | Lower | Useful for pattern analysis beyond the raw window |
The pattern: keep detail briefly, keep aggregates long. You keep the ability to spot trends and investigate, without holding every visitor’s IP address for years.
Practical steps
- Document the purpose of each log type in your records of processing
- Set a retention period per type and write down why
- Automate deletion with lifecycle rules, not good intentions
- Aggregate early. Roll raw data up into daily summaries you can keep longer
- Mention it in your privacy notice. Visitors should know you log IPs for security
- Align with other obligations, such as SOC 2 policies and PCI DSS
What this means for Cloudflare data
Cloudflare’s analytics are already aggregated for most datasets: requests, bandwidth, cache, and threats per day, by country or path. Keeping that long-term is generally low-risk.
Security Events and top-IP lists do include IP addresses. Those need a documented security purpose and a defined retention period, like any other security log.
Long-term history, low privacy footprint
MetricKeeper archives your Cloudflare analytics, which are mostly aggregates, so you keep the trends and investigation context you need. Pair it with a documented policy for anything that includes IP addresses.
Sources
- GDPR Article 5: Principles relating to processing of personal data
- GDPR Recital 49: Network and information security
- CJEU: Breyer v Bundesrepublik Deutschland, C-582/14