An Event-sourced system can be compliant with GDPR, with crypto shredding: https://www.eventstore.com/blog/protecting-sensitive-data-in...