Are IP addresses personal data under the GDPR?
Often yes, and in a security context you should assume so. Personal data is any information relating to a person who can be identified directly or indirectly, and the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). names online identifiers among the examples. An IP address does not carry a name, but it can usually be linked to one: inside a company, the address of a laptop points to the person who uses it, and an internet provider can link a public address to a subscriber. The Court of Justice of the EU has held that a dynamic IP address can be personal data for a website operator that has legal means to identify the person behind it. In practice, treat network logs, device names and connection records as personal data: have a lawful basis, limit who sees them, keep them only as long as needed and cover them in your records. NetSenX handles them as personal data under its data processing agreement and stores them in the EU.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- What counts as a personal data breach under the GDPR?
- What is the difference between a controller and a processor under the GDPR?
- What security measures does the GDPR actually require?
- Does our company need a data protection officer?
- Can we monitor our network for security on the basis of legitimate interest?
Terms used here
- GDPR (General Data Protection Regulation)
- The EU data protection law (Regulation (EU) 2016/679).
← All 20 questions on EU law: GDPR, DORA, CRA and AI ActAll topics