Audience asks how to reconcile immutable events with GDPR 'right to be forgotten'. Answer: design the system so GDPR-sensitive data lives in a separate side stream (e.g. user profile / user GDPR data) that can be dropped while the main user stream retains business history. Alternative: encrypt the sensitive data and destroy the key, leaving data in place but unreadable. Either way you must think about this up front.