Immutability in this context doesn't mean "kept forever", it just means the permission to hard-delete is separate from soft-delete. GDPR requires that good dat

Immutability in this context doesn't mean "kept forever", it just means the permission to hard-delete is separate from soft-delete. GDPR requires that good data-stewards keep backups: the controller and the processor shall implement... the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident https://gdpr-info.eu/art-32-gdpr/ https://gdpr-info.eu/art-32-gdpr/ For more details on GDPR and backups, see https://www.backup-systems.co.uk/blog/6-gdpr-implications-on-data-backup-and-disaster-recovery https://www.backup-systems.co.uk/blog/6-gdpr-implications-on... It would be inappropriate, for instance, to store user data on the blockchain.