IP addresses are personal data according to GDPR as far as I know. Whenever customer registers, I log IP address, timestamp, other details which are given by the customer such as name, address etc. After that, when customer logs in again with the same IP address, do I have to log that login with new timestamp? If I don't log every login and when customer asks for GDPR data, I will only be able to provide IP addresses he/she was having with only one timestamp, not subsequent logins' timestamps. Is this a good implementation or wrong/inadequate in terms of regulation/law?
The intention of the GDPR is to minimize the amount of personally identifiable information (PII) you store. So the GDPR never tells you that you have to log certain events. The simplest way to make sure you comply with the GDPR is to simply not store any PII at all. But that might of course conflict with legitimate business interests and with other legal obligations you might have. So when you do store PII, then the GDPR regulates under which conditions you are allowed to store PII, for how long and what you are allowed to do with that PII.
So when you receive a GDPR request from a customer to see their data, then you can say that you only have that one timestamp of their registration, because you didn't log their subsequent logins (assuming this is the truth).
GDPR means that if you handle personal data, then you need proper procedures and a valid reason for doing so. Customer consent is one valid reason, but not the only one.
- Do you have a technical or business reason to preserve records of every login, including the IP? If not, just don't do it. Data without a good purpose is just a headache for you.
- If you want to log every login (a bank might do so, I guess ...), decide what your reason is. Is it necessary to fulfill a contract? Then the contract is your reason. You have to document that and explain it in your legal boilerplate. But if you want to collect data for better targeted advertising, you probably need the consent of the data subject.
- If you have a valid reason, you also need to decide how long the data must be stored, and implement data access procedures, etc.
If you have customers, then you are a business, and you should hire an expert to advise you. You might be required to appoint a Data Protection Officer for your company, too.
As already mentioned, GDPR does not require you to collect any data; in contrary - data minimization principle requires one to use as little as possible data. But when you use data you need to have a valid purpose (why you use data? what you want to achieve?) and legal grounds (for example - consent or your legitimate interest in e.g. ensure security of your site). There are though requirements in GDPR like to ensure proof of collecting consent or ensuring security of data processing (all activities related to data on individual). That's where collecting of IP may be needed. From your question, however, it seems that you do not know why you are registering IP addresses and how would you use them. So my suggestion is to stop collecting them until you define the specific need and way you will use them.