A brokerage must keep an immutable audit trail and honour erasure requests. How can both be true?

How both are satisfied

Separate the record from the identity. The audit trail holds business facts under a pseudonymous subject reference and remains immutable; the mapping from reference to person lives in a separate store governed by the erasure rules.

Deleting the mapping renders the retained records non-identifying while preserving their integrity and their regulatory purpose.

Why it must be designed early

Retrofitting means rewriting every audit record ever written, plus every table that embedded a name, an email or an account identifier — which in most systems is nearly every table.

And the immutable records cannot be rewritten, which is precisely the point of them, so the retrofit is either impossible or requires invalidating the trail's integrity.

What else must be true

• No personal data denormalised into the immutable records "for reporting", which is exactly what defeats the separation and is the most common way it fails.
• The mapping store itself governed properly: access controlled, audited, and with its own retention and deletion process.
• Deletion propagated to every derived copy — analytics, search, backups, exports — with completion tracked rather than assumed, since a mapping deleted in one place and present in another has not been deleted.
• A legal hold that overrides deletion, recorded with scope, reason and author — so deletion cannot be a cron job doing hard deletes but must go through a service that checks holds and produces evidence.

The regulatory nuance worth stating

Erasure rights are not absolute. Most regimes provide an exemption where retention is required by law, and a brokerage's transaction records generally fall under one.

The architecture's job is not to delete everything on request but to delete what is not exempt — and to be able to demonstrate which is which, which requires the classification to be structural rather than a judgement made per request.

The practical answer to a data subject

"Your identifying information has been removed; your transaction records are retained under our regulatory obligation for the required period, and they are no longer linked to you." That is a defensible answer, and it is only available if the architecture separated the two.