Kafka, GDPR and Event Sourcing
&gt; <i>A suggestion from Michiel Rook’s blog is that maybe is enough to remove the data from the projections&#x2F;read models, and there is no need to touch the data in the event store.</i><p>No. This is very easy. The right to be forgotten means: if I’m done with your web service and I want to have my account deleted, you have to delete everything you have on me in a reasonable timeframe and which is not required by you for other laws (such as keeping receipts of my purchases for 6-10 years).<p>If someone can replay that log step by step (and I think this is the idea of Event Sourcing), and my data shows up in there for no particular reason, it’s illegal.<p>There is no need for you to archive data, if I don’t want you to create that archive or if I want you to delete that archive.<p>Also, if I haven’t used your web service after X years, you should send a friendly reminder that my account and all data will be erased soon. If I don’t reactivate, you should delete every information that helps you or anyone to identify me as a person.<p>Edit: arguing with the purpose of “archiving” is exactly this fucked up weaseling around which companies do to circumvent the law. Take responsibility for your users data and delete everything after a while or on request.