How long can you keep logs under GDPR? A 2026 guide

The GDPR doesn't give a number of days for logs. It says personal data may be kept in a form that identifies people "for no longer than is necessary" for the purpose, so you pick a period per log type, write down why, and delete or anonymise on schedule. The French regulator, the CNIL, recommends six months to one year for logs that track access and actions, a concrete figure you can measure your own policy against.

Treat what follows as a reading of the regulation and of regulator guidance, not legal advice. Before you commit to a period, have your data protection officer or counsel confirm it.

The rules for logs at a glance

Are logs personal data at all?

Usually, yes. Recital 30 names internet protocol addresses and cookie identifiers as online identifiers that can be used to identify people when combined with other data a server receives. A web server access log with an IP address, a user agent and a timestamp fits that description. So do application logs that print a user ID, an email address or a session token.

Pseudonymising doesn't take logs out of scope. Recital 26 treats pseudonymised data that can be linked back to a person with extra information as information about an identifiable person. Only truly anonymous data falls outside the GDPR, which is why aggregated counts, such as requests per hour per country, can usually be kept long after the raw lines are gone.

What to decide for each log type

• The purpose. Debugging, security monitoring, fraud prevention, billing disputes and audit trails are different purposes, and each justifies a different period.
• The lawful basis. Recital 49 supports security logging under legitimate interest. A legal duty to keep records can also apply in your sector; check which law and which period.
• The fields. Article 5(1)(c) applies to what you log, not only how long. Truncating IPs or dropping query strings can make a longer period easier to defend.
• The period and the trigger. Days after collection, after an account closes, or after an incident is closed. Recital 39 accepts either a fixed erasure date or a periodic review.
• Every copy. Log shippers, search clusters, object storage archives, backups and your log vendor each keep their own copy. A 30-day policy that a backup silently keeps for a year isn't a 30-day policy.
• Who can read them. Logs often capture passwords, tokens and personal data by accident, so limit access and record who reads them.

What the CNIL recommends

The CNIL adopted its logging recommendation on 14 October 2021. For logs that record access to and actions in a system by authorised users, it recommends keeping them between six months and one year. For internal control, it accepts up to three years in the most common cases, provided you can show and document the need. Longer periods can also follow from a legal duty to keep records, a specific purpose or a serious threat level, assessed case by case.

It also warns about the opposite problem. If the underlying data is kept for less than six months, logs shouldn't keep that data around after it's been deleted from the source.

The recommendation is French guidance, not EU law, and it targets traceability logs rather than every debug line. It's still a useful anchor when you write your own policy, because it shows the kind of reasoning a regulator expects to see. Ireland's Data Protection Commission gives no figure either: its guidance repeats that the controller sets time limits for erasure or periodic review.

A practical retention plan

Short, purpose-bound periods are easier to defend than one long period for everything. A common pattern looks like this:

1. Debug and application logs: keep them only as long as you need to reproduce problems, and strip personal data from them at the source.
2. Web access logs with IP addresses: keep them for the security and abuse window you can justify, then delete them or reduce them to anonymous counts.
3. Security and authentication logs: use the CNIL range of six months to one year as a reference, and document anything longer.
4. Audit trails required by another law: follow that law's period and name it in your record of processing.
5. Aggregates: keep anonymous statistics as long as they're useful, since they're no longer personal data.

Then put each period in your record of processing under Article 30(1)(f), state it in your privacy notice under Article 13(2)(a), and make deletion automatic. Article 5(2) puts the burden of proof on you, so a policy with no evidence that deletion runs is weak.

What your hosting and log providers keep

Your retention is limited by the shortest and longest copy in the chain. Check what each provider stores by default, and whether you can change it:

Platform	Default or included retention
Eurobase	Project logs eligible for cleanup 30 days after they're recorded, at most 10,000 rows per project in each log category
Scaleway Cockpit	Logs from Scaleway resources kept 7 days free; custom retention from 1 day to 5 years
Grafana Cloud	14 days on the free tier, 30 days on Pro
Better Stack	3 days on the free tier

Figures come from each provider's own pages, checked on 9 and 10 November 2026. For a fuller comparison of log services, see log management hosted in the EU.

If you host on Eurobase, the processor side is set out in its data processing agreement, which lists visitor IP addresses, request paths and user agents among the access log data. The privacy policy retention table says project access logs become eligible for cleanup 30 days after they're recorded and that backlogs or failures can delay deletion beyond that. Each plan comes with a monthly log allowance: Free has 256 MiB, Starter 1 GiB for €10 a month + VAT, and Pro 5 GiB for €20 a month + VAT. Eurobase runs on European infrastructure operated by Scaleway, a French provider, and its certification work for ISO 27001 and SOC 2 hasn't finished yet. The built-in logs suit day-to-day debugging; if your policy needs a year of security logs, ship them to a store you control.

Frequently asked questions

Is there a maximum log retention period in the GDPR?

No. The regulation sets a principle, not a number. Article 5(1)(e) limits storage to what is necessary for the purpose, and Recital 39 leaves it to the controller to set erasure or review dates. Any fixed figure you see comes from a regulator's guidance, a sector law or your own policy.

Can I keep IP addresses in logs for security?

Yes, if it's strictly necessary and proportionate. Recital 49 recognises network and information security as a legitimate interest. You still need a defined period, limited access and deletion once the security purpose is served.

Is 30 days a safe period for access logs?

No period is safe by default. Thirty days is short and easy to justify for debugging and abuse response, but you should still document why it fits your purpose. Some security or audit needs justify longer, which the CNIL puts at six months to one year for access logs.

Do I have to delete logs from backups too?

Storage limitation applies to every copy that still identifies people. If backups keep logs longer than your policy, either shorten the backup cycle or state the backup period and keep those copies out of normal use until they expire.

Does anonymising logs let me keep them forever?

Truly anonymous data is outside the GDPR under Recital 26. Hashing an IP or replacing a user ID with a token usually only pseudonymises it, which is still personal data. Aggregated counts with no link back to a person are the safer route.

Sources

• GDPR Article 5, Article 13 and Article 30
• GDPR Recital 26, Recital 30, Recital 39 and Recital 49
• CNIL: recommendation on logging measures and Délibération n° 2021-122 on Légifrance
• Data Protection Commission Ireland: principles of data protection
• Scaleway Cockpit pricing and changing retention
• Grafana Cloud pricing and Better Stack pricing
• Eurobase privacy policy retention, Eurobase DPA, Getting started: logs, Eurobase pricing, GDPR hosting checklist and EU region vs EU company