Are IP addresses in server logs personal data under GDPR?

In most cases, yes. In Breyer, the EU Court of Justice held in 2016 that even a dynamic IP address stored by a website is personal data for that website's operator when the operator has legal means to identify the visitor with help from the visitor's internet provider. The GDPR names IP addresses among the online identifiers that can identify people, so the safe default is to treat the IP addresses in your access logs as personal data and to give them a legal basis, a purpose and a deletion date.

What follows is a plain reading of the case law and the regulation, not legal advice. For a ruling on your own setup, ask a lawyer or your national data protection authority.

IP addresses and the GDPR at a glance

What to check in your own setup

• Every place an address lands. Server and proxy logs, app logs, error trackers, analytics, the firewall and your host's logs.
• The purpose for each copy. Security and debugging are common purposes. "We might need it later" isn't one.
• The legal basis. For security logging, that's usually legitimate interests under Article 6(1)(f), with a short balancing test written down.
• The retention period. Article 5(1)(e) says data must not be kept in identifiable form longer than the purpose needs.
• What your host does with it. If the host stores logs for you, it acts as your processor and needs a data processing agreement.
• Who else receives it. A third-party logging or monitoring service is another recipient, and possibly a transfer outside the EEA.

What the Breyer judgment decided

Patrick Breyer went to the German courts to stop federal government websites from storing his IP address with the date and time of each visit. The sites kept those records to defend against attacks and to make criminal prosecution possible. The German Federal Court of Justice asked the EU Court of Justice whether a dynamic IP address, which changes with each new connection, counts as personal data for the website operator, given that only the internet provider holds the data that links it to a subscriber.

On 19 October 2016, the Court answered yes, under a condition. A dynamic IP address stored by a website operator is personal data for that operator if it has the legal means to identify the visitor using additional information held by the visitor's internet provider. The Court noted that in Germany, legal routes appeared to exist: after a cyberattack, the operator can go to the competent authority, which can obtain the data from the provider for criminal proceedings. The operator doesn't need to hold the linking data itself.

The second half of the ruling matters just as much for logs. German law, as most commentators read it, let a site use visitor data without consent only to provide and bill that specific visit, so the data had to go once the visit ended. The Court said EU law precludes that rule, because it ruled out weighing the operator's interest against the visitor's rights. It added that a website operator may have a legitimate interest in keeping its site working beyond each single visit, which is the interest behind security logging.

What the GDPR adds

Breyer was decided under the 1995 Data Protection Directive. The GDPR repealed that directive on 25 May 2018, and its own text points the same way:

• Article 4(1) defines personal data as information about a person who can be identified directly or indirectly, including by "an online identifier".
• Recital 26 says identifiability depends on all the means reasonably likely to be used, by the controller or by another person, taking into account cost, time and available technology.
• Recital 30 names IP addresses, cookie identifiers and similar identifiers, and warns that the traces they leave, combined with other data servers receive, can be used to build profiles and identify people.
• Recital 49 says processing that's strictly necessary and proportionate for network and information security, such as stopping denial of service attacks, is a legitimate interest of the controller.

So the GDPR doesn't say every IP address is always personal data. It sets the test, and for a site that keeps addresses alongside times, paths and browser details, the test is usually met.

The 2025 SRB ruling and the "relative" view

On 4 September 2025, in EDPS v SRB, Case C-413/23 P, the Court of Justice confirmed that pseudonymised data isn't personal data in all cases and for every person. Data a recipient truly can't link back to anyone may not be personal data for that recipient. The case concerned comments passed to an auditing firm under the rules for EU institutions, not IP addresses.

The same ruling also held that, for the duty to inform people, identifiability is assessed when the data is collected and from the controller's point of view. A site that collects visitor addresses is that controller, so Breyer still applies, and SRB gives no reason to treat your own logs as anonymous.

Keeping IP logs lawfully

1. Write down why you log addresses, for example blocking abuse and investigating incidents.
2. Record the legitimate interests balancing in a few paragraphs. Recital 49 and Breyer support the security interest.
3. Pick a retention period that matches the purpose and make deletion automatic.
4. Log only what the purpose needs. Article 5(1)(c) calls this data minimisation.
5. Shorten or remove addresses where the full value isn't needed, such as in analytics. A plain hash of an IPv4 address is weak, since there are only about 4.3 billion possible values to test.
6. Mention IP logging and its purpose in your privacy notice.
7. Check your host's processing agreement and its own retention for logs it keeps on your behalf.

The GDPR hosting checklist covers the processor side in more detail, and EU log management compares where log services store data.

Where Eurobase fits

When you deploy on Eurobase, you're the controller for your visitors' data and Eurobase is your processor. The Eurobase DPA lists the data involved, including visitor IP addresses, derived location, request paths, user agents, referring sites and response sizes in project access logs.

The privacy policy's retention table gives the limits:

• Project access logs may be cleaned up from day 30 after they're ingested. Each project holds at most 10,000 rows per log category, which can remove older rows earlier, and backlogs or failed cleanups can push deletion beyond 30 days.
• Requests Eurobase blocks for restricted paths stay in an encrypted archive for 90 days, on the network security basis of Article 6(1)(f) and Recital 49.

Apps that run as Workers receive the visitor's address in X-Forwarded-For and CF-Connecting-IP headers when Eurobase knows it, as described in the Workers docs. Anything your own code writes to its database follows your own retention, while what it prints to the console lands on the Eurobase Logs page, which keeps up to 30 days and at most the newest 10,000 entries of each kind. Eurobase is registered as a business in Warsaw, Poland, and your apps run on European infrastructure run by Scaleway, a French provider. It doesn't hold ISO 27001 or SOC 2 certification yet, and work on both is in progress.

Frequently asked questions

Is a dynamic IP address personal data?

Yes, for a website operator with legal means to identify the visitor through the internet provider, as Breyer held. Most EU operators should assume they're in that position.

Do I need consent to log IP addresses?

Not for security logs in most cases. Breyer and Recital 49 support legitimate interests as the basis for logging that's necessary to keep a site secure and working. Analytics or tracking can fall under different rules, including national cookie laws.

How long can I keep IP addresses in server logs?

The GDPR sets no fixed number. Article 5(1)(e) says only as long as the purpose needs, so choose a period you can justify, write it down and delete automatically when it ends.

Is a hashed or truncated IP address anonymous?

Usually not if you can still link it back, for example with a salt or the original logs. Recital 26 treats pseudonymised data that can be attributed with extra information as personal data. Truncating enough of the address, or keeping only totals, gets closer to anonymous.

Does storing logs in the EU make them GDPR compliant?

Location helps with transfer rules, but you still need a purpose, a legal basis, a retention limit and a processing agreement with your host. Data residency vs data sovereignty explains what location does and doesn't cover.

Sources

• Court of Justice press release 112/16: Breyer, Case C-582/14
• Court of Justice press release 107/25: EDPS v SRB, Case C-413/23 P
• GDPR, Regulation (EU) 2016/679, on EUR-Lex: Articles 4, 5, 6 and 94, Recitals 26, 30 and 49
• Eurobase DPA, Eurobase privacy policy: retention and Eurobase Workers docs
• GDPR hosting checklist and EU log management