Arantor
Well-known member
Careful with that. I purposefully keep IP addresses - even after deletion of accounts - for 30 days, longer if the IP address came up in a ban.which can include IP addresses,
The rationale I give for this is because while the spirit of the GDPR is privacy, this does not extend to a miscreant causing trouble, getting banned, then requesting account deletion which in theory should include the ban because IP addresses.
When I asked the ICO about this, they seemed happy enough that the use was valid provided that I disclosed it in the terms & conditions and privacy policy, and that this was used from a security standpoint, to deal with individuals aiming to prevent the service being used. It's been a while since I had the actual references to hand but there are provisions in there for security considerations.