What can a logged action look like?

The DPA 2018 does not explain what a log looks like, but it does describe what actions you must record. Each organisation is likely to operate different systems and have different ways of recording the actions of users, to comply with their logging obligations.

For example, you could use the following format for a very basic log recording user access to a system:

Action	User / Device	IP Address	Date / Time
Logon Successful	“Name or ID”	xxxxx	xx/xx/xxxx  12:05

Or, for example, if a user erased a file, you could record the following details in the log: 

Action	File	User / Device	IP Address	Date / Time
File Erased	“File X name”	“Name or ID”	xxxxx	xx/xx/xxxx  09:25