Question

A privacy engineer must implement the right to erasure for a microservices platform. Personal data flows into a central append-only event log that feeds several downstream read models (search index, caching layer, analytics materialized views). When an erasure request is confirmed, which technical approach best ensures the individual's personal data is effectively removed while preserving the integrity of the append-only architecture?

Accepted Answer

Encrypt each individual's personal data in the event log with a per-subject key, then delete that key on erasure (crypto-shredding) and trigger rebuilds of downstream read models from the now-unreadable events

Answer

Physically delete the individual's events from the append-only log and rely on downstream services to eventually expire the corresponding cached and indexed records

Answer

Append a tombstone event flagging the record as erased and leave all prior events and downstream read models unchanged, filtering the individual out only at query time

Answer

Mark the individual's account as inactive in the primary identity service so that new events stop being generated for that subject