Senior LevelREST APIs & Web Services
How do you architect REST APIs to comply with GDPR Right to be Forgotten across microservices?
❓ Interview Prompt: Explain GDPR compliance, Right to be Forgotten (`DELETE /api/v1/users/42`), cascading erasure sagas, PII anonymization, and auditing.
Architecting GDPR data erasure ('DELETE /api/v1/users/42') across distributed microservices and immutable audit logs:
Erasure Execution Strategy:
1
Synchronous Soft-Delete: Immediately mark user as 'deleted' in auth service, revoking all active JWTs.
2
Asynchronous Erasure Saga: Dispatch a 'USER_ERASURE_REQUESTED' event to Kafka.
3
Anonymization: Replace PII fields (email, name, address) in relational databases with cryptographic hashes ('deleted_usr_883a...').
4
Audit Logs: Preserve transaction records required by financial compliance while anonymizing user identity fields.
Code Implementation Example
typescript
export async function handleGdprUserErasure(userId: string) {
// 1. Soft-delete user and revoke sessions
await authService.revokeUserSessions(userId);
// 2. Anonymize PII data across microservices
await userService.anonymizePii(userId, {
email: 'anonymized_\${crypto.randomUUID()}@erased.local',
name: 'GDPR Erased User',
phone: null
});
// 3. Dispatch async event to purge S3 uploads and analytical warehouse records
await eventBus.publish('user.gdpr.erased', { userId });
}💡Executing GDPR user PII anonymization and session revocation.
🎯 Interview Key Takeaway
Comply with GDPR Right to be Forgotten by orchestrating asynchronous erasure sagas that anonymize PII across microservices.
#GDPR#Data Privacy#Microservices#Senior
Back to all REST APIs & Web Services Questions→