Your websites have no logging at all? Remember, even an IP address is PII under GDPR.

You don't need to ask if the information you collect is necessary for your site to work.

> You don't need to ask if the information you collect is necessary for your site to work.

Shysters/pettifoggers are very "flexible" (in a negative way) in the interpretation what is "necessary for your site to work". :-(

You don't have to log IPs. And if you need them for rate limits / abuse prevention, that falls under the "necessary / legitimate interest" rule.

Security, debugging and audit logs all fall under "legitimate interest".

Just keep them out of hands of parties that might want to use them for other reasons.