GDPR Compliance

[Wulfheart]

According to the GDPR an user has the right to be forgotten. When I’m using event sourcing it is as far as I know not possible to delete previous events with personal data.
Do you have an idea how I could use event sourcing and make it GDPR-compliant?

[dilab]

You could store references of the object that is GDPR sensitive.

[antal-levente]

OR encrypt the personal data and delete the key on request. Like this the data remains there anonymously and still can be replayed.

[Wulfheart]

Thanks for your response. Encrypting the data directly in the event store may allow attackers to decrypt in the future, therefore I wouldn't use it.