🛡️ GDPR

GDPR gives users the right to have their personal data deleted. Event-driven systems keep data as a record of facts that you’re not supposed to change. You can’t reconcile the two with a DELETE statement, so it has to shape how you design events from the start.

The first article explains GDPR for developers: what users can ask for, what happens to backups, and why the real problem is that most of us can’t say what data we keep, where, or for how long. It’s not legal advice, and it says so.

The second applies that to event-driven systems. You’ll see how to keep personal data apart from the rest, how long to keep it, and how to make it unreadable when it has to go, even in events you can’t delete or have already shared. Read them in order.