How far can I go with logging and monitoring without bumping into GDPR?
Logs are often essential for security, but contain personal data. Purpose limitation, data minimisation and transparency are the levers, not max-everything by default.
Try this first
- 1State the purpose per log source: incident detection, debugging, audit trail. That determines what fields and how long you keep them.
- 2Minimise what you log. A user ID is enough; you do not need the full request with personal data. URL parameters with identifiers count as personal data.
- 3Set retention to the purpose. Many security logs run weeks to a few months; longer needs justification and a sealed environment.
- 4Limit access. SIEM access for a small team, with logs about access itself. Misuse comes from inside more often than you think.
- 5State in your privacy notice and staff regulations that you log and why. Silent monitoring is a GDPR and labour-law risk.
When to bring us in
If you want to monitor mail content or keystrokes, you cross into GDPR-plus-labour-law turf and need works council consent and a DPIA.
See also
- Does NIS2 apply to my company?Two questions decide it: are you in a listed sector, and do you meet the threshold from Recommendation 2003/361/EC (more than 50 FTE and more than EUR 10M turnover or balance sheet). Below that you are only indirectly in scope, via your customers. The threshold determines whether you are an important or essential entity depending on sector.
- What changes with the Dutch Cyber Security Act?The Cyberbeveiligingswet is the Dutch implementation of NIS2. Track NCSC for the exact effective date and the lower regulations.
- Am I personally liable as a director under NIS2?Yes. The board is accountable for approving and overseeing the cyber measures. Severe negligence can become personal.
None of the above fits?
Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.
Or skip the DIY entirely
Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.