body: I am very pleased to have found this resource and am hoping I can be guided to some clarity on some points regarding processing of webserver access logs. I have not yet found these addressed here or elsewhere.
  
  
  My partner and I host a number of websites for a range of clients. For some of those clients we consider we do not process any personal data - we set no cookies, use no analytics services, collect no data from the user via forms, and so on. We do however collect IP addresses in our webserver access logs.
  
  
  It is clear from all I have read (particularly re *Patrick Breyer vs Germany*) that we need to consider IP addresses as personal data, however I have read (I have sadly mislayed the source) that the CJEU considered there were legitimate cybersecurity interests for recording them (though see comment below).
  
  
  **My query:**
  Collection of IP addresses in access logs is noted as normal operations for a web host, and GDPR outlines provisions for doing so to maintain security and investigate breaches. But because IP addresses are personal data, do we now need to create a new contract to outline how we will use this data?
  
  
  **Additional info:**
  I see from this resource that Article 11 has a provision for my query:
  
  
  Article 11 (1) "Where, in cases referred to in paragraph 1 of this Article, the controller is able to demonstrate that it is not in a position to identify the data subject, the controller shall inform the data subject accordingly, if possible. In such cases, Articles 15 to 20 shall not apply except where the data subject, for the purpose of exercising his or her rights under those articles, provides additional information enabling his or her identification."
  
  
  <http://www.privacy-regulation.eu/en/article-11-processing-which-does-not-require-identification-GDPR.htm>
  
  
  This though would not exempt us or the Controller from having a contract for the collection of the IP address (unusable as it is for identifying a person, but recognised in law as personal data).
  
  
  
title: Contract necessary for the most basic processing under GPDR?