Event Sourcing & CQRS · Evolution and Compliance
Personal Data, GDPR and Crypto-Shredding
Honor deletion requests in an append-only store.
Immutable logs conflict with the right to erasure. Patterns: keep personal data out of events (store it in a separate, deletable store and reference it by ID), or crypto-shredding — encrypt personal fields with a per-person key held in a key store; deleting the key renders that data unreadable everywhere, including backups and replicas. Also purge read models and caches, and consider retention policies for streams.
Erasure strategies
| Approach | How | Trade-off |
|---|---|---|
| Reference external PII store | Events contain customer_id only | Joins needed; PII store deletable |
| Crypto-shredding | Encrypt PII per subject; delete key | Key management; data unreadable but present |
| Stream deletion / truncation | Delete entire streams for a subject | Breaks history; store support needed |
| Anonymize read models | Rebuild projections without PII | Must cover every read model |
Event (crypto-shredding)
{"type": "CustomerRegistered", "customer_id": "cus_19",
"pii": {"key_id": "subj-cus_19", "ciphertext": "AQICAHh...", "alg": "AES-256-GCM"}}
Erasure: delete key 'subj-cus_19' in KMS/Vault → ciphertext unreadable in events, backups, replicas.
Projections: rebuild/scrub read models; caches expire.
Common pitfalls
- Copying PII into many events and read models.
- Forgetting backups and analytics copies.
- Keys stored next to the ciphertext.
Key points
- Minimize PII in events
- Crypto-shredding for erasure
- Scrub read models and caches
Further reading: Crypto-shredding
Practice questions
How does crypto-shredding satisfy erasure in immutable logs?
Answer
Personal data is encrypted with a per-subject key; deleting the key makes all copies (events, backups, replicas) permanently unreadable without rewriting the log.
Why reference PII by ID instead of embedding it in events?
Answer
The PII store can be updated or deleted independently, avoiding immutable copies of personal data across the event history.
Open in the app to mark lessons complete, take notes and track your progress.