Our provider is going to keep access and error logs for 6 months then erase. I think I will put a statement about that in our website terms and conditions and have done with it. We have a brochure-ware site with limited interaction.
However that leaves google analytics and a chat box program to resolve. I believe both issue cookies and probably store IP addresses, I am still not clear what to do about those.