Crypto-Shredding
also called Cryptographic Erasure
Encrypting each subject's data with its own key and destroying that key to render the data permanently unreadable, achieving deletion without deleting.
The technique that resolves the direct conflict between the right to erasure and architectures built on immutability — append-only event logs, immutable backups, versioned object storage, time-travelling tables.
Each data subject's personal data is encrypted with a per-subject key held in a key management service. On an erasure request, the key is destroyed. The ciphertext remains everywhere it was — in backups, in the event log, in old snapshots — and is permanently unreadable.
What it gives you: erasure that reaches copies you cannot practically enumerate, without rewriting history and without breaking the integrity guarantees that made the immutable store worth having.
What it demands. Key management becomes critical infrastructure — losing a key is losing the data, and there is no recovery by design. Encryption must be at the right granularity, per subject rather than per table, which is a schema decision made early. Non-encrypted derivatives leak: an aggregate, an index, a search document or a cached copy containing the plaintext defeats the whole scheme, so the boundary must be traced deliberately.
And the legal position should be confirmed rather than assumed — regulators have generally accepted cryptographic erasure, but it is a judgement worth having in writing.