GDPR and Security Logs: Can a SIEM Store Personal Data? (Recital 49, Retention, Minimisation)

Lawful Basis Themes

• Often legitimate interests (Art 6(1)(f)) for security monitoring — document an LIA
• Sometimes legal obligation (sector rules) or contract necessity for providing a secure service
• Special-category data in logs is rare but high risk if present

Minimisation & Retention

• Collect only fields needed for detection/investigation
• Tiered retention (hot/warm/cold) aligned to threat-hunt and legal needs
• Pseudonymise or hash where investigation still works
• Restrict admin access; audit SIEM queries

DSARs Against Logs

Logs may be in scope for Article 15. Plan search tooling, third-party redaction, and exemptions. Do not promise “logs are never personal data.”

How CyberSilo Helps

• ThreatHawk SIEM with retention controls and access auditing
• CSA links logging controls to Art 32 / Art 5(1)(f) evidence

Frequently Asked Questions

Are IP addresses personal data?

Often yes when they can identify an individual, alone or combined with other data — treat them carefully in SIEM design.

Does Recital 49 create a new lawful basis?

No. Recitals guide interpretation. You still need an Article 6 basis (commonly legitimate interests for security).

How long can we keep security logs?

No single GDPR number. Set purpose-based retention and document it in RoPA and policy.

Related GDPR Resources

GDPR hub · Article 32 · Retention · ThreatHawk