> Any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person. It can be anything from a name, a photo, ... or a computer IP address.
Emphasis mine.
I said:
> IPs don't count as long as you're collecting them for security purposes and don't have a way to identify a person using the IP.
- the ip addresses never uniquely identify someone or
- you have a legitimate interest to collecting this data.
Neither provides carte blanche for collecting IP address.
If you have "other ways to identify somebody based on an IP address" then that wouldn't meet the criteria laid out by the lawyers.
You might be thinking of this pseudonymization stuff. My advice is not to play with it. Just delete your logs after a month unless you have a demonstrable and immediate security need for them.
That came from the legal departments from our German, UK, and French entities.
> Purpose of security doesn't change if its PII or not.
Security is the legitimate interest, an important part of collection under GDPR.
If you're too worried about this, remove the last octet from the IP or and/or it with a mask. And especially don't associate the IP with the user (by default you can't find out who's the user only by IP).
Database backups are only a problem if you save them forever, though it sounds like you are. GDPR generally requires that you regularly archive, rotate out, and clean up old data.