Logical deletion with event sourcing (potentially with sensitive data / GDPR)

Question

I understand that event sources are supposed to be immutable and append only.

However, I'm wondering how I handle a logical delete. If the user clicks 'delete' on the UI and they are expecting a hard delete, do I include a IsDeleted flag on my event? Are there other options here?

Edit: The question has special interest when there is sensitive data around, maybe stored in the event itself, and the user expects it to be completely flashed-out from our systems. This can relate to the EU GDPR regulation and laws.

Answer 1

You could publish a 'deleted' event which would remove/ mark the data as deleted in your read database, but this isn't a hard delete (which you specify in your question). You will still have the data in your event store.

Hard deletes are actually pretty difficult when using event sourcing. I assume you're working with event sourced customer data? There are usually a few solutions for this, but they aren't really pretty:

• You either don't eventsource your sensitive customer data but store this seperately and just reference this from your aggregate in some way

• You either delete old events (be aware that this might break more than you'd like, but it depends on your design / application)

• You either add a deleted event and change existing events to strip out the sensitive data.