Are logs infinitive? If yes then GDPR dislike in matter of sensitive data in the meaning a person can be indetified. If no, then is enough to tell where data handling is explained how long backups are stored — but that time must be resonable.
But… sensitive is bit different thing that demands of GDPR. Bank account number is very sensitive, but no one can’t identify a person using that; in Finland anyway.