I log traffic. I use log rotate with a 30 day rotation. No one can complain because it's gone within a GDPR compliant window of 30 days.