Yes and no... the GDPR is all about purpose, and if you keep a log for the purpose of logging unauthorized access to data this is fine if you state this fact in the contract with the employee and only store and access the logs for this purpose.

You just can not keep backups of everything for the purpose of everything.

My example can not include all cases and was written in the spirit of "we are a bunch of devs with a small project". As is monal.im .