Not a vulnerabilityNothing is broken into. The logging level is a setting, the payload is written on purpose, and the objection is to what that setting causes to be stored.
What it is
Logging is set to a level that writes the payload: the body of a request, the fields of a form, the text of a message, the parameters of a query, the response returned to the person. The line then holds the content itself instead of a reference to the record it belongs to. Because logs exist for running the system rather than for the process they describe, they usually sit outside the retention schedule of that process, are readable by more people, are copied into a search or monitoring system, and are kept for as long as storage allows.
Why it is a separate entry
Content is where the sensitive part is. A log written this way holds what someone searched for, what they wrote to a helpdesk, the contents of a report about their health or their debts, in a store that was never designed to hold it, that an access request usually never reaches, and that outlives the deletion of the record it came from.
How it arises
debug logging left on after release
a framework that writes full request and response bodies by default
an error handler that serialises the whole object it failed on
the payload written deliberately, to make support easier
Not to be confused with
Content reaching another party is User input to third parties; this entry is about the operator's own store, and content does not have to leave the organisation to be in the wrong place. A log recording that a record was opened, by whom and when, is the normal case and is not this entry.
How to establish it
A value only the person could have supplied, a distinctive marker string entered into a field for this test, appears in the log records the operator returns for that session, whether through an access request, a support export or the log store itself. The line contains the value rather than a reference to where the value is kept.
method document-comparisonQoD 85
Requirements on the measurement
use a distinctive marker string entered into a field, so a match cannot have come from anywhere else
ask for the log records of that session specifically; a general access request returns the process record, not the log
record which store answered: application log, access log, error log, or an external search or monitoring system
record the retention stated for that store separately from the retention stated for the process
What would refute it
by handThe marker appears only in the record that is part of the process itself, not in a log.finding falls
automatedThe log line holds the value in a masked form, or a reference instead of the value.finding falls
by handThe log store falls under the same retention and access rules as the process record, and an access request reaches it.weakens
by handThe logging level was raised for a bounded incident and the records were destroyed when it closed.Checkable against the change record and the retention of the store, rather than against the recollection of the engineer.weakens
Where this plugs into existing processes
The one question that surfaces itIf I type a sentence into your form, in how many stores does that sentence exist an hour later?
In a DPIA, verify this
Verify with a marker string what ends up in the log stores, and check whether those stores appear in the retention schedule at all.
As a procurement clause
Logs record events and references; payload content is not written, and every log store is named in the retention schedule with a period.
With a complaint, hand over
The marker string, the log records returned that contain it, and the retention stated for the store that returned them.
Reproduction
METHOD.md · by hand · no dedicated reproduction exists yet; follow the general method and the indicator above
Legal framing
eu-gdpr-5-1-c
eu-gdpr-5-1-b
eu-gdpr-5-1-e
Objections, and the answer
“Logs are technical data.”
The store is technical; the content is not. What determines the category is what the line contains, not which directory it sits in.
“Nobody reads them.”
Access is what counts, not habit. And a log nobody reads is a log whose retention nobody watches.
“We need it to debug.”
Then it is needed for the length of the investigation, as a reference plus the record it points to, rather than as a copy of the content kept for a year.
“They are deleted after ninety days.”
Show where that is written for this store, and check it against the monitoring system the lines were copied into. Retention set for one store rarely follows the copy.
What this does not establish
harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
unlawfulness; that is for a supervisory authority or a court
intent; a fault is usually a build decision, not a plan
absence: not finding it in one capture is not evidence that it is not there
DPE Catalogue. DPE-2026-0034: Logs recording content, not events. Schema 2.0, entry status active. Retrieved from https://totaledigitalewaarborging.nl/register/DPE-2026-0034
Measurement
When you publish a finding, cite the method version alongside the entry: “DPE-2026-0034, established under DPE Measurement Method 1.0”
Identifiers are permanent and are never
reused. An entry that is deprecated keeps its number and its address, with the reason attached, because
references to it exist elsewhere.