You forgot also making sure you aren't logging things you shouldn't log. Some are obvious maybe like passwords. Others might be less obvious like the title of every window on the user's desktop which Facebook Oculus logs. Those titles end up including every page of every website you've visited, the title of every document you've edited, and every video you've watched.
Ideally the data should be filtered before it gets to logging in the first place, but if not, you can add another layer of defense by employing censors:
