> How can we be required to delete IP addresses in our logs yet also be required to keep access audit logs for 7 years.

I don't know where you got this idea, but I strongly suggest you find someone who has experience with the GDPR and discuss this with them. These two things are not even remotely close to any grey areas that could land someone in hot water.

>How can we be required to delete IP addresses in our logs yet also be required to keep access audit logs for 7 years.

Then you may well be able to rely on the Legal Obligation basis for processing, namely that “processing is necessary for compliance with a legal obligation to which the controller is subject.”

> I can’t comply with HIPPA and GDPR and since HIPPA applies to any US based medical practitioners, that essentially cuts off all Europeans from using our services — so people in Europe who have a US based therapist — we can’t legally allow that anymore — assuming we want to be GDPR compliant.

To be honest, for better or worse I kinda tuned out your indignation at the intricacies of maintaining compliance the moment I saw "HIPPA". HIPAA - the Health Insurance Portability and Accountability Act.

Just how many Europeans would you have with US therapists? Besides, the GDPR specifically mentions data that is already covered under other privacy mandates.

> How can we be required to delete IP addresses in our logs yet also be required to keep access audit logs for 7 years.

IANAL but from what I read and heard (indirectly) from lawyers at work this is not a problem. GDPR doesn't apply to data that you are required to keep for other legal reasons.

I also ANAL, but heard this same thing directly when I asked this question at my company's GDPR briefing