Nothing about GDPR is hard ... unless your business model is to abuse your customers' personal data. Then it might be hard.<p>I <i>routinely</i> see the loudest complainers about the onerous nature of GDPR compliance suddenly get vague or stop posting when you ask for details of precisely what bit is so hard for them in particular. Note lack of those details in this present discussion, for example.<p>So far, it seems a safe assumption that the excuse makers are abusing personal data, and they know they're abusing personal data.<p>Perhaps one day a clear exception will show up.<p>I wrote up a thing here a few years ago with my actual on the ground experience of getting us compliant: <a href="https://reddragdiva.dreamwidth.org/606812.html" rel="nofollow">https://reddragdiva.dreamwidth.org/606812.html</a><p>tl;dr anything that might vaguely constitute personal data, down to Apache logs, must either be in a writable database for redactability, or deleted.<p>Since then, our legal team - who are not <i>your</i> legal team! - has advised:<p>* 30 days for operational purposes is fine actually.<p>* Go feral on anything over 30 days. You need a named person responsible for GDPR redactions.<p>* If you want to do analytics on those Apache logs, do them quickly and into a form that doesn't contain personal data.<p>I'm in the UK, which is no longer in the EU, but the GDPR laws still hold here.