IP addresses are "personal data" according to the GDPR. When saving IP addresses in web server access logs, data subjects have the right to get the log entries for the IP addresses they used (article 15 GDPR).
If the IP address is the only personal data in the log, a controller has no way to verify that a requesting person is actually the data subject. Even the requesting person’s ISP could only verify that the person is the subscriber (i.e., that the subscriber’s Internet connection had this specific IP address at a specific time), but it’s possible that someone else used the subscriber’s Internet connection at that time (e.g., a family member).
Does this mean that a controller never has to provide the log entries if the IP address is the only personal data involved?