There are a number of strategies, some described here: https://docs.eventsourcingdb.io/best-practices/gdpr-complian...