How to setup logrotate with GPG to encrypt for GDPR?

Question

As per GDPR all private data should be encrypted, so I need to encrypt all logs and retrieve them for auditing. I have chosen to perform the encryption during log rotation and to use GnuPG as my encryption method, but don't know how to invoke the gpg command during logrotate.

Answer 1

Contrary to what is often claimed, encryption of all personal data is not mandatory, but only suggested as a good option four times in the whole general data protection regulation (GDPR):

• "...implement measures to mitigate those risks, such as encryption." (Recital 83)
• "...appropriate safeguards, which may include encryption" (Art. 6, 4e)
• "...including inter alia as appropriate: (a) the pseudonymisation and encryption of personal data." (Art. 32, 1a)
• "...unintelligible to any person who is not authorised to access it, such as encryption" (Art. 34, 3a)

Rather than a requirement, encryption is a tool. An i-SCOOP acticle on GDPR encryption is a more comprehensive overview on the subject, including also some related guidelines. Risk analysis is an important part of your GDPR strategy and may reveal some risks that could be mitigated by encrypting logs. Then, this practice might be useful, but GDPR does not require it.

---

You could e.g. use a postrotate script to encrypt the rotated log with GnuPG.

/var/log/whatever.log {
    . . .
    postrotate
        gpg --encrypt --recipient my@example.com /var/log/whatever.log.1
    endscript
    . . .
}

Even better, logrotate allows substituting the default gzip with other tools, including GnuPG:

compress
compresscmd /usr/bin/gpg
compressoptions --encrypt --default-key your-key-id
compressext .gpg

This idea adopted from Ctrl.blog GDPR and personal data in web server logs makes this global. The article notices that the need for encryption depends on the type of data, discuss what personal data logs could contain and what is the legal basis for logging, as it's usually done without consent.